Vulnerability advisory
CVE-2026-6367
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Also known as BIT-drupal-2026-6367DRUPAL-CORE-2026-003GHSA-pw6f-3999-xp7g
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT git.drupalcode.org/project/drupal ↗ | |
| ac5da07ad88571dbb31dfb52f055bb0d4063f598 to before bb3d6153f69df4a5759bf855f90c50d9158f55e5 | bb3d6153f69df4a5759bf855f90c50d9158f55e5 |
| GIT github.com/drupal/drupal ↗ | |
| ac5da07ad88571dbb31dfb52f055bb0d4063f598 to before bb3d6153f69df4a5759bf855f90c50d9158f55e5 | bb3d6153f69df4a5759bf855f90c50d9158f55e5 |
Also listed as affected (7)
| |
Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 11.3.0 before 11.3.7.