Vulnerability advisory

DRUPAL-CORE-2026-016

Published Oct 14, 2026Updated Oct 17, 2026OSV record ↗

Also known as CVE-2026-108514

Severity

Severity not reported.

Affected versions

drupal/core Packagist

Affected	Fixed in
`10.3.0` to before 10.6.19	`10.6.19`Advisories →
`11.0.0` to before 11.3.19	`11.3.19`Advisories →
`11.4.0` to before 11.4.10	`11.4.10`Advisories →
`12.0.0-alpha1` to before 12.0.0-beta2	`12.0.0-beta2`Advisories →
Also listed as affected (144) `10.3.0` `10.3.1` `10.3.10` `10.3.11` `10.3.12` `10.3.13` `10.3.14` `10.3.2` `10.3.3` `10.3.4` `10.3.5` `10.3.6` `10.3.7` `10.3.8` `10.3.9` `10.4.0` `10.4.0-beta1` `10.4.0-rc1` `10.4.1` `10.4.10` `10.4.2` `10.4.3` `10.4.4` `10.4.5` `10.4.6` `10.4.7` `10.4.8` `10.4.9` `10.5.0` `10.5.0-beta1` `10.5.0-rc1` `10.5.1` `10.5.10` `10.5.11` `10.5.12` `10.5.2` `10.5.3` `10.5.4` `10.5.5` `10.5.6` `10.5.7` `10.5.8` `10.5.9` `10.6.0` `10.6.0-beta1` `10.6.0-rc1` `10.6.1` `10.6.10` `10.6.11` `10.6.12` `10.6.13` `10.6.14` `10.6.15` `10.6.16` `10.6.17` `10.6.18` `10.6.2` `10.6.3` `10.6.4` `10.6.5` `10.6.6` `10.6.7` `10.6.8` `10.6.9` `11.0.0` `11.0.1` `11.0.10` `11.0.11` `11.0.12` `11.0.13` `11.0.2` `11.0.3` `11.0.4` `11.0.5` `11.0.6` `11.0.7` `11.0.8` `11.0.9` `11.1.0` `11.1.0-beta1` `11.1.0-rc1` `11.1.1` `11.1.10` `11.1.2` `11.1.3` `11.1.4` `11.1.5` `11.1.6` `11.1.7` `11.1.8` `11.1.9` `11.2.0` `11.2.0-alpha1` `11.2.0-beta1` `11.2.0-rc1` `11.2.0-rc2` `11.2.1` `11.2.10` `11.2.11` `11.2.12` `11.2.13` `11.2.14` `11.2.2` `11.2.3` `11.2.4` `11.2.5` `11.2.6` `11.2.7` `11.2.8` `11.2.9` `11.3.0` `11.3.0-alpha1` `11.3.0-beta1` `11.3.0-rc1` `11.3.0-rc2` `11.3.1` `11.3.10` `11.3.11` `11.3.12` `11.3.13` `11.3.14` `11.3.16` `11.3.17` `11.3.18` `11.3.2` `11.3.3` `11.3.4` `11.3.5` `11.3.6` `11.3.7` `11.3.8` `11.3.9` `11.4.0` `11.4.1` `11.4.2` `11.4.3` `11.4.4` `11.4.5` `11.4.6` `11.4.7` `11.4.8` `11.4.9` `12.0.0-alpha1` `12.0.0-beta1`

Description

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

References

Webwww.drupal.org/sa-core-2026-016 ↗