Executive brief
Drupal, a popular content management system used to build and manage websites, is vulnerable to a security flaw in how it handles pop-up modal windows. An attacker could use this flaw to execute malicious scripts in a user's browser, potentially leading to unauthorized actions or the theft of sensitive session information. This issue affects various versions of Drupal core, and administrators should update to the latest patched versions to protect their sites and users.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Drupal core's jQuery integration for AJAX modal dialog boxes. The root cause is the insufficient sanitization of certain options passed to modal dialogs, allowing an attacker to inject malicious scripts. The attack vector is network-based and requires minimal user interaction (typically clicking a link or visiting a crafted page). Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session. Patches are available in Drupal versions 10.5.9, 10.6.7, 11.2.11, and 11.3.7.
Affected products
- Drupal Drupal core 8.0.0 to 10.5.8, 10.6.0 to 10.6.6, 11.0.0 to 11.2.10, 11.3.0 to 11.3.6
Timeline
- 2026-04-15: advisory: Original Drupal security advisory (SA-CORE-2026-001) published
- 2026-05-19: disclosed: NVD publication date
- 2026-05-20: other: GitHub Advisory Database entry created