CVE-2026-108514: Drupal Core Navigation Module XSS Vulnerability
Summary
CVE-2026-108514: The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. Affects drupal/core across 4 version ranges.
>= 10.3.0, < 10.6.19
>= 11.0.0, < 11.3.19
>= 11.4.0, < 11.4.10
>= 12.0.0-alpha1, < 12.0.0-beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is a widely used open-source content management system (CMS) that allows users to create and manage websites easily. The Navigation module is a core component that helps in managing the site's menu structure. This module is essential for providing users with a navigable interface. However, it has been found to have a vulnerability that can be exploited if not properly managed.
Vulnerability Detail
The Navigation module in Drupal Core does not adequately sanitize certain attributes, leading to a cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability arises when users with specific permissions can enter HTML tags containing certain data attributes, potentially compromising the security of the site and its users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.3.0, < 10.6.1910.6.19composer require drupal/core:10.6.19 -
>= 11.0.0, < 11.3.1911.3.19composer require drupal/core:11.3.19 -
>= 11.4.0, < 11.4.1011.4.10composer require drupal/core:11.4.10 -
>= 12.0.0-alpha1, < 12.0.0-beta212.0.0-beta2composer require drupal/core:12.0.0-beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict permissions for roles that can enter HTML tags or manage menus until the update can be applied. Ensure that only trusted users have access to these permissions.
Conclusion
The CVE-2026-108514 vulnerability in the Drupal Core Navigation module poses a significant risk due to its potential for XSS attacks. It is crucial for site administrators to update to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2026-108514 is a vulnerability in the Drupal Core Navigation module that allows for cross-site scripting (XSS) attacks due to insufficient sanitization of certain attributes.
Any Drupal site using affected versions of the core Navigation module is at risk, particularly those with users who have permissions to enter HTML tags.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider restricting permissions for users who can enter HTML tags or manage menus as a temporary measure.
Failure to address this vulnerability may lead to XSS attacks, where attackers can execute malicious scripts in the context of your users, potentially stealing sensitive information or compromising user accounts.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
