CVE-2026-6365: Drupal Core Cross-Site Scripting Vulnerability
Summary
CVE-2026-6365: Drupal core is Vulnerable to Cross-Site Scripting. Affects drupal/core across 4 version ranges.
>= 8.0.0, < 10.5.9
>= 10.6.0, < 10.6.7
>= 11.0.0, < 11.2.11
>= 11.3.0, < 11.3.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2026-6365 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that allows users to build and manage websites. It is known for its flexibility, scalability, and extensive community support. However, like any software, Drupal can be vulnerable to security threats. The identified vulnerability affects Drupal core versions 8.0.0 through 10.5.8, 10.6.0 through 10.6.6, 11.0.0 through 11.2.10, and 11.3.0 through 11.3.6, allowing attackers to execute malicious scripts in the context of a user's session.
Vulnerability Detail
The vulnerability stems from improper neutralization of input during web page generation, commonly known as Cross-Site Scripting (XSS). This allows attackers to inject malicious scripts into web pages viewed by other users. The ramifications of this vulnerability can include unauthorized access to sensitive information, session hijacking, and the potential for further attacks on the web application. The vulnerability is classified under CWE-79, indicating its nature as a scripting issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.5.910.5.9composer require drupal/core:10.5.9 -
>= 10.6.0, < 10.6.710.6.7composer require drupal/core:10.6.7 -
>= 11.0.0, < 11.2.1111.2.11composer require drupal/core:11.2.11 -
>= 11.3.0, < 11.3.711.3.7composer require drupal/core:11.3.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and output encoding to mitigate the risk of XSS attacks. However, this is not a substitute for applying the official patches.
Conclusion
The identified Cross-Site Scripting vulnerability in Drupal core poses a significant risk to users and their data. It is essential to update to the latest patched versions to safeguard against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/core →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to unauthorized actions.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability may lead to unauthorized access to user sessions, data theft, and further exploitation of the web application.
Implementing input validation and output encoding can help mitigate XSS risks temporarily, but it is essential to apply the official patches as soon as possible.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
