{"id":"CVE-2026-15917","aliases":["DRUPAL-CORE-2026-011","EUVD-2026-66184","GHSA-pw57-w545-279f"],"status":"published","title":"Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00206,"percentile":0.10739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-07-15T19:51:57Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"Packagist","package":"drupal/core","fixed_in":["11.3.14","11.4.4","11.3.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.3.0"},{"fixed":"11.3.14"}]},{"type":"ECOSYSTEM","events":[{"introduced":"11.4.0"},{"fixed":"11.4.4"}]},{"type":"ECOSYSTEM","events":[{"introduced":"11.2.0"},{"fixed":"11.3.0"}]}],"versions":["11.2.0","11.2.1","11.2.10","11.2.11","11.2.12","11.2.13","11.2.14","11.2.2","11.2.3","11.2.4","11.2.5","11.2.6","11.2.7","11.2.8","11.2.9","11.3.0","11.3.0-alpha1","11.3.0-beta1","11.3.0-rc1","11.3.0-rc2","11.3.1","11.3.10","11.3.11","11.3.12","11.3.13","11.3.2","11.3.3","11.3.4","11.3.5","11.3.6","11.3.7","11.3.8","11.3.9","11.4.0","11.4.1","11.4.2","11.4.3"]}],"products":[{"vendor":"drupal","product":"drupal core"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-011","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15917","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pw57-w545-279f"},{"url":"https://git.drupalcode.org/project/drupal","tags":["web"]},{"url":"https://www.drupal.org/project/drupal","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15917.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15917","title":"Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.","status":"published","published":"2026-08-25T22:22:23.68Z","modified":"2026-08-26T14:48:20.519Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-66184","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.","status":"published","published":"2026-08-25T22:22:23Z","modified":"2026-08-26T14:48:20Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:30.898869Z"}],"ghsa":[{"id":"GHSA-pw57-w545-279f","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.","status":"published","published":"2026-08-26T00:31:02Z","modified":"2026-08-28T15:30:33Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:11:07.541511Z"}],"nvd":[{"id":"CVE-2026-15917","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.","status":"published","published":"2026-08-25T23:16:56.437Z","modified":"2026-08-28T15:29:44.967Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-15917","title":"Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.","status":"published","published":"2026-08-25T22:22:23.68Z","modified":"2026-10-28T02:31:07.525456958Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DRUPAL-CORE-2026-011","description":"Drupal core 11.2 and above integrate the HTMX JavaScript library.\n\nDrupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.\n\nThe vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.","status":"published","published":"2026-07-15T19:51:57Z","modified":"2026-07-15T20:56:45.436756Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}