Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Drupal core Navigation module has a permission-gated XSS flaw tracked as CVE-2026-108514.
Drupal advisory SA-CORE-2026-016 discloses CVE-2026-108514, a moderately critical cross-site scripting flaw in the Drupal core Navigation module. Insufficient sanitization of certain attributes can allow XSS, but an attacker needs permission to enter HTML with specific data attributes or the administer menu permission. Drupal scores the risk 12/25, with basic access complexity, user-level privileges, some confidentiality and integrity impact, theoretical exploitability, and uncommon target distribution. Affected ranges include Drupal 10.3.0 and later, 11.0 and 11.4 lines, and 12.0.0-alpha1 before 12.0.0-beta2; sites should install the latest release.
- Navigation module fails to sanitize certain HTML data attributes.
- Drupal rates it 12/25, with theoretical exploitability and uncommon distribution.
- Attackers need HTML-entry or administer-menu permission.
- Patched by installing the latest supported Drupal core release.
- CVEs
- CVE-2026-108514
- Vendors
- Drupal
- Products
- Drupal coreNavigation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108514 | — | — | — |
From the original article
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 10. 3. 0 = 11.
By Drupal Security Team · drupal.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.