CVE-2026-8493: Drupal Colorbox Inline Module XSS Vulnerability
Summary
CVE-2026-8493: This module enables you to open content already on the page within a colorbox. Affects drupal/colorbox_inline versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Colorbox Inline module allows users to display content in a modal overlay, enhancing user experience on web pages. It is designed for easy integration with Drupal sites, providing a simple way to present images, videos, and other content types. However, a security flaw has been identified in this module that exposes it to Cross-Site Scripting (XSS) attacks, particularly due to improper sanitization of user input.
Vulnerability Detail
The vulnerability arises from the module's failure to adequately sanitize the 'data-colorbox-inline' attribute value before it is processed by jQuery. This oversight allows attackers to inject malicious scripts into the web page, which can execute in the context of the user's browser. The implications of this vulnerability are significant, as it could lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware. It is important to note that an attacker must possess a role with permissions to enter HTML tags containing specific data attributes to exploit this vulnerability.
How To Fix
Minimum fixed version
2.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict user roles that have permission to enter HTML tags containing the 'data-colorbox-inline' attribute. This will limit the potential for exploitation until the module can be updated.
Conclusion
The identified XSS vulnerability in the Drupal Colorbox Inline module poses a significant risk to users and their data. It is crucial to update to the patched version to safeguard against potential attacks. Additionally, implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for drupal/colorbox_inline →
FAQ
The Colorbox Inline module is a Drupal extension that allows users to display content in a modal overlay, enhancing the visual presentation of images, videos, and other content types on a web page.
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider restricting user permissions related to HTML input to mitigate the risk of exploitation.
For more information, you can reach out to the Drupal Security Team or visit the official Drupal security advisory page.
