CVE-2026-81167: Drupal Address Suggestion Module XSS Vulnerability
Summary
CVE-2026-81167: The Address Suggestion module provides address autocomplete functionality using configured address providers. Affects drupal/address_suggestion versions < 1.0.25. Fixed in 1.0.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Address Suggestion module for Drupal provides users with address autocomplete functionality by utilizing various configured address providers. This module enhances user experience by simplifying the process of entering addresses. However, it is crucial to ensure that the data returned by these providers is properly sanitized to prevent security vulnerabilities.
Vulnerability Detail
The vulnerability arises from the Address Suggestion module's failure to adequately sanitize the address suggestion data returned by configured providers. This oversight can lead to a cross-site scripting (XSS) vulnerability, where an attacker could inject malicious content into the suggestions. For this attack to be successful, the attacker must first be able to manipulate the data returned by an address provider, and then a user must perform a search that results in the display of the malicious suggestion.
How To Fix
Minimum fixed version
1.0.25
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the use of address providers that are known to return untrusted data until the module is updated. Additionally, ensure that users are educated about the risks of interacting with untrusted suggestions.
Conclusion
The CVE-2026-81167 vulnerability in the Drupal Address Suggestion module highlights the importance of data sanitization in preventing XSS attacks. Users are encouraged to update to the latest version of the module to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for drupal/address_suggestion →
FAQ
The Address Suggestion module is a Drupal extension that provides autocomplete functionality for address fields, enhancing user experience during data entry.
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing a temporary workaround by limiting the use of untrusted address providers and educating users about the risks.
More details about the vulnerability can be found in the advisory published by the Drupal Security Team, which outlines the nature of the issue and its impact.
