DRUPAL-CONTRIB-2020-027
This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.
The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability requires the user have 'administer Easy Breadcrumb settings permission'.
What each source reports
OSV No score
This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.
The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability requires the user have 'administer Easy Breadcrumb settings permission'.
- Record
DRUPAL-CONTRIB-2020-027- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/easy_breadcrumbPackagist:https://packages.drupal.org/8 |
before 1.13.0 | 1.13.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2020-027 is a vulnerability with no CVSS score yet in drupal/easy_breadcrumb, published July 22, 2020. No source lists public exploit code. Fixed in drupal/easy_breadcrumb 1.13.0.