{"id":"CVE-2026-87942","kind":"vulnerability","aliases":["CVE-2026-87942"],"related":[],"title":"Drupal SafeDelete: stored cross-site scripting in versions up to 1.0.88","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.","summary":"Drupal SafeDelete module versions up to 1.0.88 fail to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted input can run script in other users' browsers when the page renders.","severity":"medium","cvss":4.6,"epss":0.00162,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php"],"not_affected_if":["sites-without-safedelete"],"how_to_check":"- Check the installed SafeDelete version with `drush pm:list --filter=safedelete` or by reviewing `composer show drupal/safedelete`\n- unknown whether other checks apply","fix":"- Upgrade the Drupal SafeDelete module to a version later than `1.0.88` (exact fixed version: unknown)","status":"open","published_at":"2026-10-22T02:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:29+00:00","updated_at":"2026-10-25T04:35:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:35:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal SafeDelete module to a version later than `1.0.88` (exact fixed version: unknown)","reach":"unknown","title":"Drupal SafeDelete: stored cross-site scripting in versions up to 1.0.88","impact":"medium","summary":"Drupal SafeDelete module versions up to 1.0.88 fail to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted input can run script in other users' browsers when the page renders.","category":"package","nicknames":[],"who_cares":["drupal","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site","analyst_note":"Confirm the fixed SafeDelete version and the exact stored-input path at the Drupal security advisory or NVD entry.","how_to_check":"- Check the installed SafeDelete version with `drush pm:list --filter=safedelete` or by reviewing `composer show drupal/safedelete`\n- unknown whether other checks apply","needs_analyst":true,"not_affected_if":["sites-without-safedelete"],"who_is_affected":"Sites running the Drupal SafeDelete module at version 1.0.88 or earlier are affected. The sources do not say which configurations or roles expose the stored input, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000592,"input_tokens":3348,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87942':15A,18A '0.0.0':86C '1.0.88':12A,28B,88C 'affect':82C 'allow':77C 'attack':44B 'browser':56B 'craft':48B 'cross':5A,40B,70C 'cross-sit':4A,39B,69C 'cve':13A,16A 'drupal':1A,19B,22B,75C 'enabl':37B 'fail':29B 'generat':34B,68C 'improp':61C 'input':32B,49B,64C 'issu':81C 'modul':24B 'neutral':31B,62C 'packag':20B 'page':36B,59B,67C 'php':21B 'render':60B 'run':51B 'safedelet':2A,23B,76C,83C 'script':7A,42B,52B,72C 'site':6A,41B,71C 'store':3A,38B,47B,78C 'user':55B 'version':9A,25B,84C 'vulner':73C 'web':35B,66C 'xss':79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal SafeDelete module at version 1.0.88 or earlier are affected. The sources do not say which configurations or roles expose the stored input, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87942","severity":null,"published_at":"2026-10-22T02:17:03+00:00","modified_at":"2026-10-22T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87942","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87942","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}