{"id":"CVE-2026-84915","aliases":["DRUPAL-CONTRIB-2026-123","EUVD-2026-107876","GHSA-xf3c-7v88-48w2"],"status":"published","title":"Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00205,"percentile":0.10614,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-09-02T16:29:52Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/component_blocks","fixed_in":["1.2.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/component_blocks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}]}],"products":[{"vendor":"drupal","product":"component blocks"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-123","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84915","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xf3c-7v88-48w2"},{"url":"https://git.drupalcode.org/project/component_blocks","tags":["web"]},{"url":"https://www.drupal.org/project/component_blocks","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84915.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-84915","title":"Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.","status":"published","published":"2026-10-22T01:22:14.36Z","modified":"2026-10-22T17:09:33.536Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-107876","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.","status":"published","published":"2026-10-22T01:22:14Z","modified":"2026-10-22T17:09:33Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:34.732609Z"}],"ghsa":[{"id":"GHSA-xf3c-7v88-48w2","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.","status":"published","published":"2026-10-22T03:33:38Z","modified":"2026-10-22T18:40:25Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:17.600276Z"}],"nvd":[{"id":"CVE-2026-84915","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.","status":"published","published":"2026-10-22T02:17:01.953Z","modified":"2026-10-22T18:17:30.083Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-84915","title":"Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.","status":"published","published":"2026-10-22T01:22:14.36Z","modified":"2026-10-28T02:30:51.703069174Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DRUPAL-CONTRIB-2026-123","description":"This module enables you use UI Patterns with blocks, for use in Layout Builder.\n\nThe module doesn't sufficiently validate user input before passing to token replacement.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts.","status":"published","published":"2026-09-02T16:29:52Z","modified":"2026-09-02T19:55:49.52622Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}