Executive brief
Drupal's Layout Builder module, which administrators use to design page layouts, contains a cross-site scripting vulnerability in block label sanitization. An attacker with access to the Layout Builder editing interface can inject malicious code that executes when another user views the same interface, potentially enabling account compromise or unauthorized actions within Drupal.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in Drupal's Layout Builder module caused by insufficient sanitization of block labels. An authenticated attacker with Layout Builder editing access can inject malicious JavaScript into block labels, which is stored server-side and executed when other users access the Layout Builder editing interface. The attack requires both the attacker and the target to use the Layout Builder editing interface, limiting the attack surface to users with page layout configuration permissions. Patches are available for Drupal 10.6.13+, 11.3.14+, and 11.4.4+. Versions 11.0.x, 11.1.x, and 11.2.x are end-of-life and do not receive security coverage.
Affected products
- Drupal Drupal core before 10.6.13, 11.3.0 before 11.3.14, 11.4.0 before 11.4.4, 11.0.x, 11.1.x, 11.2.x
Timeline
- 2026-07-15: disclosed
- 2026-08-25: advisory