CVE-2026-87942: Persistent XSS Vulnerability in Drupal Safedelete Module
Summary
CVE-2026-87942: This module enables you to manage content deletion and provides reports for identifying orphaned content. Affects drupal/safedelete versions < 1.0.88. Fixed in 1.0.88. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Safedelete module for Drupal is designed to manage content deletion and generate reports that help identify orphaned content within a website. It allows users to effectively handle content lifecycle management, ensuring that deleted content does not leave behind orphaned nodes that could clutter the system. However, this module has a critical vulnerability that arises from inadequate sanitization of node titles in its reports.
Vulnerability Detail
The vulnerability stems from the module's failure to properly sanitize node titles when displaying the orphaned nodes report. This oversight allows attackers to inject malicious scripts into the node titles, leading to a persistent cross-site scripting (XSS) vulnerability. If exploited, this could allow an attacker to execute arbitrary JavaScript in the context of a user's browser, potentially compromising user sessions, stealing sensitive information, or redirecting users to malicious sites. The risk is heightened as an attacker only needs permission to create content of a type that is included in the orphaned nodes report to exploit this vulnerability.
How To Fix
Minimum fixed version
1.0.88
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict permissions for creating content types that are included in the orphaned nodes report until the module is updated. This can help prevent potential exploitation while a patch is being applied.
Conclusion
The CVE-2026-87942 vulnerability in the Drupal Safedelete module highlights the importance of proper input sanitization. Users are strongly advised to update to version 1.0.88 or later to protect against potential XSS attacks. Additionally, utilizing tools like Vulert can enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for drupal/safedelete →
FAQ
CVE-2026-87942 is a vulnerability identifier for a persistent cross-site scripting (XSS) issue found in the Drupal Safedelete module.
If you are using the Safedelete module version lower than 1.0.88, your site is vulnerable. You can check your version in the module's configuration page or by using the Vulert playground.
Exploitation of this vulnerability could allow attackers to execute malicious scripts in users' browsers, leading to session hijacking, data theft, or redirection to malicious sites.
Yes, you can restrict permissions for creating content types that appear in the orphaned nodes report to limit exposure until the module is updated.
Vulert monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time insights without needing access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/safedelete.
