Read the docs
TI-2026-82854 Aliases CVE-2026-108514GHSA-8pmv-83q8-mcx5

Cross-site scripting in Drupal core

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Drupal core versions from 10.3.0 before 10.6.19, from 11.0.0 before 11.3.19, from 11.4.0 before 11.4.10, and from 12.0.0-alpha1 before 12.0.0-beta2 are affected. An input neutralization flaw (CWE-79) lets crafted input inject script into web pages that other users view. An attacker needs low privileges, and a user must interact with a crafted page for the script to run. The CVSS 3.1 base score is 6.5 (Medium), with a changed scope and low confidentiality, integrity and availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed Drupal core (Drupal): 10.6.19, 11.3.19, 11.4.10 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrupalDrupal core10.3.0 to before 10.6.19; 11.0.0 to before 11.3.19; 11.4.0 to before 11.4.10; 12.0.0-alpha1 to before 12.0.0-beta210.6.19, 11.3.19, 11.4.10, 12.0.0-beta2Patch availableCNA
  • Drupal core VendorDrupal Affected 10.3.0 to before 10.6.19; 11.0.0 to before 11.3.19; 11.4.0 to before 11.4.10; 12.0.0-alpha1 to before 12.0.0-beta2 Fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*——Drupal
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions — — ·Drupal

Remediation

Upgrade Drupal core to 10.6.19, 11.3.19, 11.4.10 or 12.0.0-beta2, depending on the installed branch.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Drupal core (Drupal) Fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Drupal core 10.6.19, 11.3.19 and 2 more versions

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-82852 Reflection injection in Drupal core allows remote code executionPriority LOW 38
    • TI-2026-82855 Cross-site scripting in Drupal core allows script injectionPriority LOW 28
    Show all 3 records →

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-108514
  2. 2026-10-30 Alias added: GHSA-8pmv-83q8-mcx5
  3. 2026-11-06 CVSS score added · CISA ADP
  4. 2026-11-06 CISA SSVC decision points changed

References

Other 1

  • TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
  • TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
  • TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
See all 941 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences