Executive brief
Monster Menus is a Drupal module that manages hierarchical page structures with granular permissions. The module fails to sanitize HTML in page titles when displayed in the tree browser, allowing attackers with page creation permissions to inject and execute arbitrary JavaScript in other users' sessions, potentially compromising accounts or stealing sensitive data.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Monster Menus Drupal module affecting versions before 9.5.3. The vulnerability exists in the tree browser component, which displays page names without proper HTML sanitization. An attacker with the ability to create or edit pages can inject malicious HTML and JavaScript into page titles. When other users view the tree browser, the injected script executes in their browser within the context of their authenticated session. This allows attackers to steal session tokens, redirect users, or perform actions on behalf of victims. The attack requires attackers to possess page creation/editing privileges, limiting the threat to authenticated users with moderate permissions.
Affected products
- Drupal Monster Menus before 9.5.3
Timeline
- 2026-08-26: disclosed
- 2026-08-27: patched: Version 9.5.3 released