{"id":"CVE-2026-84915","kind":"vulnerability","aliases":["CVE-2026-84915"],"related":[],"title":"Drupal Component blocks: stored XSS in versions up to 1.2.7","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.","summary":"The Drupal Component blocks module has a stored cross-site scripting flaw in versions 0.0.0 through 1.2.7. An attacker who can store content that renders through these blocks can run script in other users' browsers.","severity":"medium","cvss":4.6,"epss":0.00162,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","other","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Component blocks module version with `drush pm:list --filter=components` or the Drupal extend page\n- unknown","fix":"- Upgrade Drupal Component blocks to a version later than `1.2.7`, as listed in the advisory\n- unknown","status":"open","published_at":"2026-10-22T02:17:01+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:30+00:00","updated_at":"2026-10-25T04:35:30+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:35:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Drupal Component blocks to a version later than `1.2.7`, as listed in the advisory\n- unknown","reach":"unknown","title":"Drupal Component blocks: stored XSS in versions up to 1.2.7","impact":"medium","summary":"The Drupal Component blocks module has a stored cross-site scripting flaw in versions 0.0.0 through 1.2.7. An attacker who can store content that renders through these blocks can run script in other users' browsers.","category":"other","nicknames":[],"who_cares":["drupal","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in other users' browsers via stored content","analyst_note":"Confirm the fixed version and which user role can store the payload, from the NVD and Drupal security advisory pages.","how_to_check":"- Check the installed Component blocks module version with `drush pm:list --filter=components` or the Drupal extend page\n- unknown","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Component blocks module at version 1.2.7 or earlier. The sources do not say which roles can store the content or whether default configuration is exposed, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000575,"input_tokens":3346,"output_tokens":480,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-84915':13A,16A '0.0.0':37B,85C '1.2.7':10A,39B,87C 'affect':80C 'allow':75C 'attack':41B 'block':3A,25B,50B,74C,82C 'browser':57B 'compon':2A,24B,73C,81C 'content':45B 'cross':31B,67C 'cross-sit':30B,66C 'cve':11A,14A 'drupal':1A,17B,23B,72C 'flaw':34B 'generat':65C 'host':21B 'improp':58C 'input':61C 'issu':79C 'modul':26B 'neutral':59C 'page':64C 'render':47B 'run':52B 'script':33B,53B,69C 'self':20B 'self-host':19B 'site':32B,68C 'store':4A,29B,44B,76C 'user':56B 'version':7A,36B,83C 'vulner':70C 'web':63C 'xss':5A,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Component blocks module at version 1.2.7 or earlier. The sources do not say which roles can store the content or whether default configuration is exposed, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84915","severity":null,"published_at":"2026-10-22T02:17:01+00:00","modified_at":"2026-10-22T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84915","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84915","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}