CVE-2026-6365
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
- Record
CVE-2026-6365- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-31000
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
- Record
EUVD-2026-31000- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f3cj-mjqm-fhvj
Drupal core is Vulnerable to Cross-Site Scripting
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
- Record
GHSA-f3cj-mjqm-fhvj- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score
Drupal core Denial of Service vulnerability
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-6ccv-8fgf-cjpw- Updated
- 2026-11-02
NVD
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
- Record
CVE-2026-6365- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
- Record
CVE-2026-6365- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-f3cj-mjqm-fhvj
Drupal core is Vulnerable to Cross-Site Scripting
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
- Record
GHSA-f3cj-mjqm-fhvj- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-drupal-2026-6365 No score
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
- Record
BIT-drupal-2026-6365- Updated
- 2026-11-02
OSVCLSA-2026-1778201069 No score
TuxCare security update for drupal/core (1 CVE)
TuxCare rebuilt drupal/core to address 1 CVE. Fixed in 9.5.11-p2+tuxcare.
- Record
CLSA-2026-1778201069- Updated
- 2026-11-02
OSVCLSA-2026-1784682869 No score
TuxCare security update for drupal/core (21 CVEs)
TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.
- Record
CLSA-2026-1784682869- Updated
- 2026-11-02
OSVDRUPAL-CORE-2026-001 No score
Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability.
- Record
DRUPAL-CORE-2026-001- Updated
- 2026-11-02
OSVGHSA-6ccv-8fgf-cjpw No score
Drupal core Denial of Service vulnerability
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-6ccv-8fgf-cjpw- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
8.0.0 up to 10.1.8 | 10.1.8 |
drupal/corePackagist |
10.2.0 up to 10.2.2 | 10.2.2 |
drupal/corePackagist |
8.0.0 up to 10.5.9 | 10.5.9 |
drupal/corePackagist |
10.6.0 up to 10.6.7 | 10.6.7 |
drupal/corePackagist |
11.0.0 up to 11.2.11 | 11.2.11 |
drupal/corePackagist |
11.3.0 up to 11.3.7 | 11.3.7 |
drupalBitnami |
8.0.0 up to 10.5.9, 10.6.0 up to 10.6.7, 11.0.0 up to 11.2.11, 11.3.0 up to 11.3.7 | 10.5.910.6.711.2.1111.3.7 |
drupal/coreTuxCare:Packagist |
9.5.11 up to 9.5.11-p2+tuxcare, plus listed versions 9.5.11-p1+tuxcare |
9.5.11-p2+tuxcare |
drupal/coreTuxCare:Packagist From an advisory covering 20 CVEs |
8.9.20 up to 8.9.20-p1+tuxcare | 8.9.20-p1+tuxcare |
drupal/corePackagist |
8.0.0 up to 10.5.9, 10.6.0 up to 10.6.7, 11.0.0 up to 11.2.11, 11.3.0 up to 11.3.7, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7 |
10.5.910.6.711.2.1111.3.7 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
8.0.0 up to 10.1.8, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4 |
10.1.8 |
drupal/corePackagist |
10.2.0 up to 10.2.2, plus listed versions 10.2.1 |
10.2.2 |
drupal/corePackagist |
8.0.0 up to 10.5.9, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7 |
10.5.9 |
drupal/corePackagist |
10.6.0 up to 10.6.7, plus listed versions 10.6.110.6.210.6.310.6.410.6.510.6.6 |
10.6.7 |
drupal/corePackagist |
11.0.0 up to 11.2.11, plus listed versions 11.0.111.0.1011.0.1111.0.1211.0.13 Show 36 moreShow less11.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.911.1.011.1.0-beta111.1.0-rc111.1.111.1.1011.1.211.1.311.1.411.1.511.1.611.1.711.1.811.1.911.2.011.2.0-alpha111.2.0-beta111.2.0-rc111.2.0-rc211.2.111.2.1011.2.211.2.311.2.411.2.511.2.611.2.711.2.811.2.9 |
11.2.11 |
drupal/corePackagist |
11.3.0 up to 11.3.7, plus listed versions 11.3.111.3.211.3.311.3.411.3.511.3.6 |
11.3.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-6365 is a medium vulnerability (CVSS 6.1) in Drupal, published February 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in drupal/core 10.1.8.
References
drupal.org/sa-core-2026-001
github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff
Left out here: 1,015 versions. The JSON record has them.