CVE-2026-81201: Cross-Site Scripting Vulnerability in Drupal Monster Menus
Summary
CVE-2026-81201: This module enables you to create one or more multisites with highly granular page permissions. Affects drupal/monster_menus versions < 9.5.3. Fixed in 9.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Monster Menus module allows users to create multiple multisites with detailed page permissions. It is designed to enhance the management of menus and navigation within Drupal sites, providing flexibility and control over how content is displayed. However, this module has a critical vulnerability that can be exploited if proper precautions are not taken.
Vulnerability Detail
The vulnerability arises from insufficient sanitization of HTML code in page names when displayed in the built-in tree browser of the Monster Menus module. This oversight can lead to a cross-site scripting (XSS) vulnerability, allowing attackers to inject and execute arbitrary JavaScript within the context of a user's session. The risk is heightened for users who can create pages with HTML-supported titles, making it crucial for site administrators to address this issue promptly.
How To Fix
Minimum fixed version
9.5.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict user permissions to prevent unauthorized users from creating pages with HTML-supported titles until the module is updated.
Conclusion
The CVE-2026-81201 vulnerability in the Drupal Monster Menus module poses a significant risk due to its potential for cross-site scripting attacks. It is crucial for site administrators to update to version 9.5.3 or later to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for drupal/monster_menus →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to execute arbitrary JavaScript in a user's session.
Any Drupal site using the Monster Menus module prior to version 9.5.3 is at risk, especially if users can create pages with HTML titles.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, restrict permissions for users who can create pages with HTML titles until the module is updated.
Detailed information can be found in the advisory published by the Drupal Security Team, as well as on vulnerability databases like CVE.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/monster_menus.
