{"id":"CVE-2026-58591","aliases":["DRUPAL-CONTRIB-2026-069","EUVD-2026-43073","GHSA-xj92-p35c-g452"],"status":"published","title":"Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00228,"percentile":0.13692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-07-01T17:24:05Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/colorbox","fixed_in":["2.1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/colorbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"2.2.0"}]}]}],"products":[{"vendor":"colorbox_project","product":"colorbox"},{"vendor":"drupal","product":"colorbox"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-069","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58591","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xj92-p35c-g452"},{"url":"https://git.drupalcode.org/project/colorbox","tags":["web"]},{"url":"https://www.drupal.org/project/colorbox","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58591.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-58591","title":"Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.","status":"published","published":"2026-07-10T21:46:18.632Z","modified":"2026-07-13T18:16:59.392Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-43073","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.","status":"published","published":"2026-07-10T21:46:18Z","modified":"2026-07-13T18:16:59Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:01.134466Z"}],"ghsa":[{"id":"GHSA-xj92-p35c-g452","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.","status":"published","published":"2026-07-11T00:31:49Z","modified":"2026-07-13T21:32:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:26.474991Z"}],"nvd":[{"id":"CVE-2026-58591","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.","status":"published","published":"2026-07-10T22:16:45.387Z","modified":"2026-10-25T15:10:00.147Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:28.771746Z"}],"osv":[{"id":"CVE-2026-58591","title":"Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.","status":"published","published":"2026-07-10T21:46:18.632Z","modified":"2026-10-28T02:30:24.767647634Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DRUPAL-CONTRIB-2026-069","description":"The Colorbox module integrates with the Colorbox JavaScript library to display content in an overlay above the page.\n\nThe module doesn't sufficiently protect against injection of malicious JavaScript under certain scenarios.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role that permits them to enter HTML content.","status":"published","published":"2026-07-01T17:24:05Z","modified":"2026-09-10T03:45:36.748007425Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}