DRUPAL-CORE-2026-012

At a glance

Published: 2026-07-15 19:52 UTC
Updated: 2026-07-15 20:56 UTC
CVE: CVE-2026-55805

Description

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 0, fixed 10.6.13 ; introduced 11.3.0, fixed 11.3.14 ; introduced 11.4.0, fixed 11.4.4 ; introduced 11.0.0, fixed 11.1.0 ; introduced 11.1.0, fixed 11.2.0 ; introduced 11.2.0, fixed 11.3.0

References

https://www.drupal.org/sa-core-2026-012 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence