CVE-2026-87939: Drupal Feed Block Module XSS Vulnerability
Summary
CVE-2026-87939: The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. Affects drupal/feed_block across 2 version ranges.
< 2.0.2
>= 3.0.0, < 3.0.2
Fixed in 2.0.2 or 3.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Feed Block module for Drupal is designed to display items from remote RSS/Atom feeds as a block content type. It allows users to integrate external content into their Drupal sites seamlessly. However, due to insufficient validation and sanitization of the RSS feeds, it is vulnerable to cross-site scripting (XSS) attacks, which can compromise the security of the site and its users.
Vulnerability Detail
The vulnerability arises from the Feed Block module's failure to adequately validate or sanitize the RSS feeds it generates. This oversight can lead to stored cross-site scripting (XSS) vulnerabilities, where an attacker can inject malicious scripts into the feed. When users view the affected block, the malicious script executes in their browsers, potentially leading to data theft, session hijacking, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.22.0.2 -
>= 3.0.0, < 3.0.23.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the Feed Block module until you can apply the necessary updates. This will prevent the execution of any potentially malicious scripts until the module is secured.
Conclusion
The CVE-2026-87939 vulnerability in the Drupal Feed Block module poses a significant risk due to its potential for XSS attacks. It is crucial for users to update to the latest patched versions to secure their applications and protect their users from malicious activities.
See every vulnerability recorded for drupal/feed_block →
FAQ
The Feed Block module allows Drupal users to display content from external RSS/Atom feeds as blocks on their site.
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
If you are using an affected version of the Feed Block module, your site may be vulnerable. You can check your application's vulnerability status using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, consider disabling the Feed Block module as a temporary measure to mitigate the risk.
More information can be found in the advisory published by the Drupal Security Team, as well as on the CVE database.
