# CVE-2026-6365: Drupal core cross-site scripting in AJAX modal dialog boxes

Source: https://junglewise.ai/threats/cve-2026-6365-drupal-core-cross-site-scripting-in-ajax-modal-dialog-boxes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-6365 · Severity: medium · CVSS 6.1 · Published 2026-05-19

Drupal, a popular content management system used to build and manage websites, is vulnerable to a security flaw in how it handles pop-up modal windows. An attacker could use this flaw to execute malicious scripts in a user's browser, potentially leading to unauthorized actions or the theft of sensitive session information. This issue affects various versions of Drupal core, and administrators should update to the latest patched versions to protect their sites and users.

Technologies: [Drupal](https://junglewise.ai/threats/technologies/drupal), [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core), [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-6365 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6365 being exploited in the wild.

**How severe is CVE-2026-6365?** Medium severity, with a CVSS score of 6.1, published 19 May 2026.

**Which products and versions are affected?** Drupal 8.0.0 to 10.5.8, 10.6.0 to 10.6.6, 11.0.0 to 11.2.10, 11.3.0 to 11.3.6; Drupal Core 8.0.0 to < 10.5.9, 10.6.0 to < 10.6.7, 11.0.0 to < 11.2.11, 11.3.0 to < 11.3.7; drupal/core (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=10.5.9, ECOSYSTEM:introduced=8.0.0,fixed=10.5.9|ECOSYSTEM:introduced=10.6.0,fixed=10.6.7|ECOSYSTEM:introduced=11.0.0,fixed=11.2.11|ECOSYSTEM:introduced=11.3.0,fixed=11.3.7.

**Is there a fix for CVE-2026-6365?** Yes. drupal/core (Packagist): upgrade to 10.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6365 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6365?** Check whether you run Drupal, Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- drupal/core (Packagist): upgrade to 10.5.9 or later

  ```sh
  composer require drupal/core:^10.5.9
  ```


## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Drupal core's jQuery integration for AJAX modal dialog boxes. The root cause is the insufficient sanitization of certain options passed to modal dialogs, allowing an attacker to inject malicious scripts. The attack vector is network-based and requires minimal user interaction (typically clicking a link or visiting a crafted page). Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session. Patches are available in Drupal versions 10.5.9, 10.6.7, 11.2.11, and 11.3.7.

## Affected products

- Drupal Drupal core 8.0.0 to 10.5.8, 10.6.0 to 10.6.6, 11.0.0 to 11.2.10, 11.3.0 to 11.3.6

## Identifiers

- CVE-2026-6365
- DRUPAL-CORE-2026-001
- GHSA-f3cj-mjqm-fhvj

## Timeline

- 2026-04-15: advisory: Original Drupal security advisory (SA-CORE-2026-001) published
- 2026-05-19: disclosed: NVD publication date
- 2026-05-20: other: GitHub Advisory Database entry created

## References

- [https://www.drupal.org/sa-core-2026-001](https://www.drupal.org/sa-core-2026-001)

## Related threats

- [Drupal core Link module cross-site scripting in markup sanitization](https://junglewise.ai/threats/cve-2026-108515-drupal-core-2026-015-the-drupal-core-link-module-provides-a)
- [Drupal Navigation module cross-site scripting in attributes](https://junglewise.ai/threats/cve-2026-108514-drupal-core-2026-016-the-navigation-module-doesn-t-sufficiently)
- [Drupal Core remote code execution in Field UI module](https://junglewise.ai/threats/cve-2026-108097-drupal-core-2026-014-a-remote-code-execution-vulnerability)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [Drupal stored cross-site scripting in Layout Builder](https://junglewise.ai/threats/cve-2026-55805-drupal-stored-cross-site-scripting-in-layout-builder)