CVE-2026-15917: Drupal Core XSS Vulnerability in HTMX Integration
Summary
CVE-2026-15917: Drupal core 11.2 and above integrate the HTMX JavaScript library. Affects drupal/core across 3 version ranges.
>= 11.2.0, < 11.3.0
>= 11.3.0, < 11.3.14
>= 11.4.0, < 11.4.4
Fixed in 11.3.0, 11.3.14 or 11.4.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) that enables users to build and manage websites. It is known for its flexibility, scalability, and a robust ecosystem of modules and themes. In version 11.2 and above, Drupal integrates the HTMX JavaScript library, which enhances user interactions on web pages. However, this integration has introduced a vulnerability related to insufficient sanitization of certain HTMX attributes, potentially exposing users to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from Drupal core's XSS filter failing to adequately sanitize specific attributes associated with the HTMX library. This oversight allows attackers to inject malicious scripts into web pages, which can be executed in the context of the user's browser. The impact of this vulnerability is significant, as it could lead to unauthorized access to sensitive information, session hijacking, or defacement of the website. It is important to note that an attacker must have the ability to insert HTML with the vulnerable attributes for the exploit to be successful.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 11.2.0, < 11.3.011.3.0composer require drupal/core:11.3.0 -
>= 11.3.0, < 11.3.1411.3.14composer require drupal/core:11.3.14 -
>= 11.4.0, < 11.4.411.4.4composer require drupal/core:11.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict the ability to insert HTML with the specific HTMX attributes until the patch is applied. This can be done by reviewing user permissions and sanitizing input data where applicable.
Conclusion
The CVE-2026-15917 vulnerability in Drupal core highlights the importance of maintaining up-to-date software to protect against potential XSS attacks. Users are encouraged to apply the necessary updates promptly and consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2026-15917 is a vulnerability in Drupal core that allows for cross-site scripting (XSS) due to insufficient sanitization of HTMX attributes.
Affected versions include Drupal core 11.2 and above, specifically versions >=11.3.0 <11.3.14 and >=11.4.0 <11.4.4.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to user data, session hijacking, and the ability to execute malicious scripts in the user's browser.
To apply the patch, update your Drupal core to version 11.3.14 or 11.4.4 using Composer with the command: composer update drupal/core.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
