{"id":"CVE-2026-114536","kind":"vulnerability","aliases":["CVE-2026-114536"],"related":[],"title":"Drupal USWDS Paragraph Components: stored XSS through unsanitized input","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.","summary":"The Drupal USWDS Paragraph Components module fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content can run script in the browsers of people who view that page.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","uswds"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the USWDS Paragraph Components module in the Drupal project (for example with `drush pm:list` or the module's `.info.yml` file).\n- Confirm whether the site uses the module's paragraph components at all.","fix":"- USWDS Paragraph Components: versions up to and including `3.1.3` are listed as affected; the fixed version is unknown.","status":"open","published_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:58+00:00","updated_at":"2026-10-30T04:29:58+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:58Z","model":"claude-haiku-5-5","output":{"fix":"- USWDS Paragraph Components: versions up to and including `3.1.3` are listed as affected; the fixed version is unknown.","reach":"internet","title":"Drupal USWDS Paragraph Components: stored XSS through unsanitized input","impact":"medium","summary":"The Drupal USWDS Paragraph Components module fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content can run script in the browsers of people who view that page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","uswds","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Check the Drupal security advisory for the fixed version and whether editor-level access is required; source is only the NVD entry.","how_to_check":"- Check the installed version of the USWDS Paragraph Components module in the Drupal project (for example with `drush pm:list` or the module's `.info.yml` file).\n- Confirm whether the site uses the module's paragraph components at all.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that install the USWDS Paragraph Components module, at versions listed as affected, where users can enter content that is later displayed to visitors. Sites that do not use this module can skip it. The sources do not state the exact trigger conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":4122,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114536':12A,15A '-2026':11A,14A '0.0.0':89C '3.1.3':91C 'affect':83C 'allow':78C 'attack':43B 'browser':53B 'compon':4A,26B,77C,86C 'content':47B 'cross':39B,69C 'cross-sit':38B,68C 'cve':10A,13A 'drupal':1A,16B,23B,74C 'enabl':36B 'fail':28B 'generat':33B,67C 'host':20B 'improp':60C 'input':9A,31B,63C 'issu':82C 'modul':27B 'neutral':30B,61C 'packag':17B 'page':35B,59B,66C 'paragraph':3A,25B,76C,85C 'peopl':55B 'run':49B 'script':41B,50B,71C 'self':19B 'self-host':18B 'site':40B,70C 'store':5A,37B,46B,79C 'unsanit':8A 'uswd':2A,21B,24B,75C,84C 'version':87C 'view':57B 'vulner':72C 'web':34B,65C 'xss':6A,80C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that install the USWDS Paragraph Components module, at versions listed as affected, where users can enter content that is later displayed to visitors. Sites that do not use this module can skip it. The sources do not state the exact trigger conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114536","severity":null,"published_at":"2026-10-30T04:18:12+00:00","modified_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}