{"id":"CVE-2026-81167","aliases":["DRUPAL-CONTRIB-2026-103","EUVD-2026-70008","GHSA-mwrm-3j7f-h8rm"],"status":"published","title":"Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00242,"percentile":0.15489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-08-26T17:32:54Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/address_suggestion","fixed_in":["1.0.25"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/address_suggestion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25"}]}]}],"products":[{"vendor":"address_suggestion_project","product":"address_suggestion"},{"vendor":"drupal","product":"address suggestion"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-103","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81167","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mwrm-3j7f-h8rm"},{"url":"https://git.drupalcode.org/project/address_suggestion","tags":["web"]},{"url":"https://www.drupal.org/project/address_suggestion","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81167.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-81167","title":"Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.","status":"published","published":"2026-09-02T12:32:15.447Z","modified":"2026-09-02T14:00:12.216Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-70008","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.","status":"published","published":"2026-09-02T12:32:15Z","modified":"2026-09-02T14:00:12Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:16.020579Z"}],"ghsa":[{"id":"GHSA-mwrm-3j7f-h8rm","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.","status":"published","published":"2026-09-02T15:34:47Z","modified":"2026-09-02T15:34:48Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:11:16.730606Z"}],"nvd":[{"id":"CVE-2026-81167","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.","status":"published","published":"2026-09-02T13:18:12.467Z","modified":"2026-09-09T18:53:16.05Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"CVE-2026-81167","title":"Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.","status":"published","published":"2026-09-02T12:32:15.447Z","modified":"2026-10-28T02:31:00.100587133Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"DRUPAL-CONTRIB-2026-103","description":"The Address Suggestion module provides address autocomplete functionality using configured address providers.\n\nThe module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to inject malicious content into data returned by a configured address provider, and a user must perform a search that returns the malicious suggestion.","status":"published","published":"2026-08-26T17:32:54Z","modified":"2026-08-26T22:41:57.557158Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}