Vulnerability advisory

DRUPAL-CORE-2026-011

Published Jul 15, 2026Updated Jul 15, 2026OSV record ↗

Severity

Severity not reported.

Affected versions

Affected	Fixed in
`11.3.0` to before 11.3.14	`11.3.14`Advisories →
`11.4.0` to before 11.4.4	`11.4.4`Advisories →
`11.2.0` to before 11.3.0	`11.3.0`Advisories →
Also listed as affected (37) `11.2.0` `11.2.1` `11.2.10` `11.2.11` `11.2.12` `11.2.13` `11.2.14` `11.2.2` `11.2.3` `11.2.4` `11.2.5` `11.2.6` `11.2.7` `11.2.8` `11.2.9` `11.3.0` `11.3.0-alpha1` `11.3.0-beta1` `11.3.0-rc1` `11.3.0-rc2` `11.3.1` `11.3.10` `11.3.11` `11.3.12` `11.3.13` `11.3.2` `11.3.3` `11.3.4` `11.3.5` `11.3.6` `11.3.7` `11.3.8` `11.3.9` `11.4.0` `11.4.1` `11.4.2` `11.4.3`

Drupal core 11.2 and above integrate the HTMX JavaScript library.

Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.