CVE-2026-6367: Drupal Core Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2026-6367: Drupal core allows Cross-Site Scripting (XSS). Affects drupal/core versions >= 11.3.0, < 11.3.7. Fixed in 11.3.7. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2026-6367 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to build and manage websites and applications. It is known for its flexibility, scalability, and strong community support. However, like any software, Drupal can be susceptible to vulnerabilities. The specific issue at hand is a Cross-Site Scripting (XSS) vulnerability in Drupal core, which can allow attackers to inject malicious scripts into web pages viewed by users.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to execute arbitrary JavaScript in the context of the user's browser. This can lead to various malicious activities, including data theft, session hijacking, or defacement of the website. The affected versions of Drupal core range from 11.3.0 to just before 11.3.7, making it critical for users of these versions to address the issue promptly.
How To Fix
Minimum fixed version
11.3.7
This is the first release that contains the fix.
composer require drupal/core:11.3.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization measures in your application to mitigate the risk of XSS attacks. However, this is not a substitute for applying the official patch.
Conclusion
The Cross-Site Scripting (XSS) vulnerability in Drupal core poses a significant risk to users of affected versions. It is crucial to update to the latest patched version to safeguard your application against potential attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your software.
See every vulnerability recorded for drupal/core →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and session integrity.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to user data, session hijacking, and other malicious activities that can compromise the integrity of your website.
Yes, it is highly recommended to update to the patched version (11.3.7 or later) as soon as possible to protect your application from potential attacks.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
