Vulnerability advisory

CVE-2026-6365

Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

Published May 19, 2026Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2026-6365DRUPAL-CORE-2026-001GHSA-f3cj-mjqm-fhvj

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT git.drupalcode.org/project/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before a0e6da01ecde2b2466123c880a3428bd1cb14b46	`a0e6da01ecde2b2466123c880a3428bd1cb14b46`
920f3f7ab87ba2cca9191ec292d356197de4bc0a to before ae9246d7b736c771e7154be358aa7edd0c884dac	`ae9246d7b736c771e7154be358aa7edd0c884dac`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before 7beb610d518983c2cbd1aa58df320781335474c2	`7beb610d518983c2cbd1aa58df320781335474c2`
ac5da07ad88571dbb31dfb52f055bb0d4063f598 to before bb3d6153f69df4a5759bf855f90c50d9158f55e5	`bb3d6153f69df4a5759bf855f90c50d9158f55e5`
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before a0e6da01ecde2b2466123c880a3428bd1cb14b46	`a0e6da01ecde2b2466123c880a3428bd1cb14b46`
920f3f7ab87ba2cca9191ec292d356197de4bc0a to before ae9246d7b736c771e7154be358aa7edd0c884dac	`ae9246d7b736c771e7154be358aa7edd0c884dac`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before 7beb610d518983c2cbd1aa58df320781335474c2	`7beb610d518983c2cbd1aa58df320781335474c2`
ac5da07ad88571dbb31dfb52f055bb0d4063f598 to before bb3d6153f69df4a5759bf855f90c50d9158f55e5	`bb3d6153f69df4a5759bf855f90c50d9158f55e5`
Also listed as affected (46) `10.5.8` `10.6.6` `11.2.10` `11.3.6` `10.6.5` `11.3.5` `10.6.4` `11.3.4` `10.6.3` `11.3.3` `10.6.2` `11.3.2` `11.3.1` `10.6.1` `11.3.0` `10.6.0` `11.2.9` `10.5.7` `10.5.5` `11.2.6` `10.5.4` `11.2.5` `10.5.3` `11.2.4` `10.5.2` `11.2.3` `10.5.1` `11.2.2` `11.2.1` `11.2.0` `10.5.0` `11.2.0-rc2` `10.5.0-rc1` `10.5.0-beta1` `11.2.0-beta1` `11.2.0-alpha1` `11.0.0-alpha1` `10.1.0-alpha1` `10.0.0-alpha5` `10.0.0-alpha4` `10.0.0-alpha3` `10.0.0-alpha1` `9.0.0-alpha2` `9.0.0-alpha1` `8.1.0-beta1` `8.0.0`

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

CVE-2026-6365

Affected versions

Repository

Description

References