# CVE-2026-58587: Drupal Canvas cross-site scripting in Canvas AI submodule

Source: https://junglewise.ai/threats/cve-2026-58587-drupal-canvas-cross-site-scripting-in-canvas-ai-submodule  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-58587 · Severity: info · CVSS 4.8 · Published 2026-07-10

Drupal Canvas is a tool that allows site builders to design websites and manage content through a browser interface. A security flaw in its AI chat component allows users to upload malicious image files that are not properly checked. This could allow an attacker to execute unauthorized scripts in another user's browser, potentially leading to the theft of session information or unauthorized actions on the site.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas](https://junglewise.ai/threats/technologies/packagist-https-packages-drupal-org-8-drupal-canvas). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-58587 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58587 being exploited in the wild.

**How severe is CVE-2026-58587?** Informational severity, with a CVSS score of 4.8, published 10 July 2026.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas ECOSYSTEM:introduced=0,fixed=1.4.2|ECOSYSTEM:introduced=1.5.0,fixed=1.5.2|ECOSYSTEM:introduced=1.6.0,fixed=1.6.1|ECOSYSTEM:introduced=1.7.0,fixed=1.7.1.

**Is there a fix for CVE-2026-58587?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas: upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58587 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58587?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas: upgrade to 1.4.2 or later

## Technical details

A cross-site scripting (XSS) vulnerability exists in the Canvas AI submodule of the Drupal Canvas project. The vulnerability stems from improper neutralization of input during web page generation, specifically involving image files uploaded via a custom API for use within the AI web chat. These files are insufficiently validated before being written to the Drupal temporary directory. An attacker with low privileges could exploit this to upload a malicious file that executes arbitrary JavaScript in the context of a victim's browser session. The issue is fixed in versions 1.4.2, 1.5.2, 1.6.1, and 1.7.1.

## Affected products

- Drupal Drupal Canvas <1.4.2, >=1.5.0 <1.5.2, >=1.6.0 <1.6.1, >=1.7.0 <1.7.1

## Identifiers

- CVE-2026-58587
- DRUPAL-CONTRIB-2026-065

## Timeline

- 2026-07-01: patched: Security advisory and fixed versions released by Drupal.
- 2026-07-10: disclosed: CVE published to NVD.

## References

- [https://www.drupal.org/project/canvas](https://www.drupal.org/project/canvas)
- [https://www.drupal.org/sa-contrib-2026-065](https://www.drupal.org/sa-contrib-2026-065)

## Related threats

- [Drupal Canvas cross-site scripting via improper file validation](https://junglewise.ai/threats/cve-2026-58588-drupal-canvas-cross-site-scripting-via-improper-file-validation)
- [DRUPAL-CONTRIB-2026-017 - This module enables you to easily theme and build an entire website using only their…](https://junglewise.ai/threats/cve-2026-3216-drupal-contrib-2026-017-this-module-enables-you-to-easily-theme)
- [DRUPAL-CONTRIB-2026-006 - This Drupal Canvas module is a new visual page builder for Drupal. You can create reusable…](https://junglewise.ai/threats/cve-2026-1553-drupal-contrib-2026-006-this-drupal-canvas-module-is-a-new-visual)