DRUPAL-CORE-2026-011

At a glance

Published: 2026-07-15 19:51 UTC
Updated: 2026-07-15 20:56 UTC
CVE: CVE-2026-15917

Description

Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 11.3.0, fixed 11.3.14 ; introduced 11.4.0, fixed 11.4.4 ; introduced 11.2.0, fixed 11.3.0

References

https://www.drupal.org/sa-core-2026-011 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence