Is CVE-2026-55805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55805 being exploited in the wild.

How severe is CVE-2026-55805?

Medium severity, with a CVSS score of 5.4, published 25 August 2026.

Which products and versions are affected?

Drupal Core before 10.6.13, 11.3.0 before 11.3.14, 11.4.0 before 11.4.4, 11.0.x, 11.1.x, 11.2.x; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.6.13|ECOSYSTEM:introduced=11.3.0,fixed=11.3.14|ECOSYSTEM:introduced=11.4.0,fixed=11.4.4|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0|ECOSYSTEM:introduced=11.2.0,fixed=11.3.0.

Is there a fix for CVE-2026-55805?

Yes. drupal/core (Packagist): upgrade to 10.6.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55805 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55805?

Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55805: Drupal stored cross-site scripting in Layout Builder

CVE-2026-55805 · Severity: medium · CVSS 5.4 · Published 2026-08-25

Drupal's Layout Builder module, which administrators use to design page layouts, contains a cross-site scripting vulnerability in block label sanitization. An attacker with access to the Layout Builder editing interface can inject malicious code that executes when another user views the same interface, potentially enabling account compromise or unauthorized actions within Drupal.

Technologies: Drupal Core, drupal/core (Packagist). Vendors: Drupal, Packagist.

Quick answers

Is CVE-2026-55805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55805 being exploited in the wild.
How severe is CVE-2026-55805?: Medium severity, with a CVSS score of 5.4, published 25 August 2026.
Which products and versions are affected?: Drupal Core before 10.6.13, 11.3.0 before 11.3.14, 11.4.0 before 11.4.4, 11.0.x, 11.1.x, 11.2.x; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.6.13|ECOSYSTEM:introduced=11.3.0,fixed=11.3.14|ECOSYSTEM:introduced=11.4.0,fixed=11.4.4|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0|ECOSYSTEM:introduced=11.2.0,fixed=11.3.0.
Is there a fix for CVE-2026-55805?: Yes. drupal/core (Packagist): upgrade to 10.6.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55805 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55805?: Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

drupal/core (Packagist): upgrade to 10.6.13 or later
```
composer require drupal/core:^10.6.13
```

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in Drupal's Layout Builder module caused by insufficient sanitization of block labels. An authenticated attacker with Layout Builder editing access can inject malicious JavaScript into block labels, which is stored server-side and executed when other users access the Layout Builder editing interface. The attack requires both the attacker and the target to use the Layout Builder editing interface, limiting the attack surface to users with page layout configuration permissions. Patches are available for Drupal 10.6.13+, 11.3.14+, and 11.4.4+. Versions 11.0.x, 11.1.x, and 11.2.x are end-of-life and do not receive security coverage.

Affected products

Drupal Drupal core before 10.6.13, 11.3.0 before 11.3.14, 11.4.0 before 11.4.4, 11.0.x, 11.1.x, 11.2.x

Identifiers

CVE-2026-55805
DRUPAL-CORE-2026-012

Timeline

2026-07-15: disclosed
2026-08-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.