Vulnerability

CERT-In Vulnerability Note CIVN-2026-0469
Cross-Site Scripting Vulnerability in Drupal Core

Original Issue Date:September 21, 2026

Severity Rating: MEDIUM

Software Affected

Drupal Core versions between 10.5.0 and 10.6.17
Drupal Core versions between 11.0.0 and 11.3.17
Drupal Core versions between 11.4.0 and 11.4.7

Overview

Cross-Site Scripting (XSS) vulnerability has been reported in Drupal Core, which could allow an attacker to execute arbitrary code on the targeted system.

Target Audience:
All end-user organizations and individuals using Drupal.

Risk Assessment:
High risk of unauthenticated XSS exploitation.

Impact Assessment:
Potential for arbitrary script execution and/or compromise of system.

Description

Drupal Core is an open-source content management system used to build and manage websites and web applications.

Cross-Site Scripting (XSS) vulnerability has been reported in Drupal Core due to a security flaw in the third-party CKEditor library used for WYSIWYG editing. An attacker could exploit this vulnerability to inject malicious content that is subsequently processed by CKEditor and execute arbitrary JavaScript in the browser of a targeted user on the targeted system.

Successful exploitation of this vulnerability could allow an attacker to compromise user sessions, access sensitive information, or perform unauthorized actions with the privileges of the targeted user on the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor:
https://www.drupal.org/sa-core-2026-013

Vendor Information

Drupal
https://www.drupal.org/

References

https://www.drupal.org/sa-core-2026-013

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India