DRUPAL-CORE-2026-001

At a glance

Published: 2026-04-15 19:24 UTC
Updated: 2026-09-10 03:45 UTC
CVE: CVE-2026-6365
Aliases: BIT-drupal-2026-6365, GHSA-f3cj-mjqm-fhvj

Description

Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 10.5.9 ; introduced 10.6.0, fixed 10.6.7 ; introduced 11.0.0, fixed 11.2.11 ; introduced 11.3.0, fixed 11.3.7

References

https://www.drupal.org/sa-core-2026-001 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence