October 2026 - Security-news - lists.drupal.org

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-232 Project: Block Attributes [1] Project machine name: block_attributes Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site Scripting Affected versions: <2.1.0 CVE IDs: CVE-2026-114534 Description: This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the administer blocks permission. Solution: Install the latest version: * If you use the Block Attributes module, upgrade to Block Attributes 2.1.0 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * David Suissa (dydave) [5] * Kostia Bohach (_shy) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [9], provisional member of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/block_attributes [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/block_attributes/releases/2.1.0 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/dydave [6] https://www.drupal.org/u/_shy [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mohit_aghera [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-231 Project: Ágora Transparency Theme [1] Project machine name: agora_theme Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <1.2.3 CVE IDs: CVE-2026-114533 Description: This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whose download of the file is refused, can still read the file's contents on the page. A preview rendered for one visitor can also be cached and shown to another. This vulnerability is mitigated by the fact that the site must store the CSV files outside the public file system, and must restrict their download beyond access to the content itself with an additional module or custom code. Files in the public file system are not affected. Solution: Install the latest version: If you use the Ágora Transparency Theme for Drupal 11, upgrade to Ágora Transparency Theme 1.2.3 [3]. Reported By: * Andrés Moreno Rubio (andresmoreno28) [4] Fixed By: * Andrés Moreno Rubio (andresmoreno28) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/agora_theme [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/agora_theme/releases/1.2.3 [4] https://www.drupal.org/u/andresmoreno28 [5] https://www.drupal.org/u/andresmoreno28 [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-230 Project: UI Icons [1] Project machine name: ui_icons Date: 2026-October-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <1.1.3 || >=2.0.0 <2.0.2 CVE IDs: CVE-2026-114532 Description: This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button. Solution: Install the latest version: * If you use the UI Icons 2.0.x module, upgrade to UI Icons 2.0.2 [3] * If you use the UI Icons 1.1.x module, upgrade to UI Icons 1.1.3 [4] UI Icons 1.0.x is not supported. Sites using it should upgrade to UI Icons 1.1.3 or 2.0.2. Reported By: * Jean Valverde (mogtofu33) [5] Fixed By: * Jean Valverde (mogtofu33) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/ui_icons [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ui_icons/releases/2.0.2 [4] https://www.drupal.org/project/ui_icons/releases/1.1.3 [5] https://www.drupal.org/u/mogtofu33 [6] https://www.drupal.org/u/mogtofu33 [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-229 Project: Sector Distribution [1] Project machine name: sector Date: 2026-October-21 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <10.3.3 || >=10.4.0 <10.4.2 CVE IDs: CVE-2026-107260 Description: Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity. Solution: Install the latest version: * If you use the 10.3.x Sector distribution, upgrade to Sector 10.3.3 [3] * If you use the 10.4.x Sector distribution, upgrade to Sector 10.4.2 [4] Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By: * Drew Webber (mcdruid) [6] of the Drupal Security Team * Soames (somatick) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/sector [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/sector/releases/10.3.3 [4] https://www.drupal.org/project/sector/releases/10.4.2 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/somatick [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-228 Project: Swiper formatter [1] Project machine name: swiper_formatter Date: 2026-October-21 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <2.1.2 || >=3.0.0 <3.1.0 CVE IDs: CVE-2026-114531 Description: The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker would need a role with permission to edit the caption. Solution: Install the latest version: * If you use the Swiper formatter module 3.x, upgrade to Swiper formatter 3.1.0 [3] * If you use the Swiper formatter module 2.x, upgrade to Swiper formatter 2.1.2 [4] Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team * Julian Pustkuchen (anybody) [6] * Joshua Sedler (grevil) [7] Fixed By: * Drupal Lady (bbu23) [8] * Joshua Sedler (grevil) [9] * Drew Webber (mcdruid) [10] of the Drupal Security Team * nk_ [11] Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/swiper_formatter [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/swiper_formatter/releases/3.1.0 [4] https://www.drupal.org/project/swiper_formatter/releases/2.1.2 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/anybody [7] https://www.drupal.org/u/grevil [8] https://www.drupal.org/u/bbu23 [9] https://www.drupal.org/u/grevil [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/nk_ [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/mcdruid [15] https://www.drupal.org/u/poker10 [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-227 Project: Dopup [1] Project machine name: dopup Date: 2026-October-21 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information disclosure Affected versions: <1.0.7 CVE IDs: CVE-2026-114530 Description: The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms. Solution: Install the latest version: * If you use the dopup module, upgrade to Dopup 1.0.7 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] * Rodel Duterte (rduterte) [5] Fixed By: * Rodel Duterte (rduterte) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/dopup [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/dopup/releases/1.0.7 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/rduterte [6] https://www.drupal.org/u/rduterte [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-226 Project: CSV Field [1] Project machine name: csv_field Date: 2026-October-21 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site Scripting Affected versions: <2.0.10 || >=3.0.0 <3.0.7 CVE IDs: CVE-2026-114529 Description: This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content that contains a CSV field. Solution: Install the latest version: * If you use the CSV Field 3.0.x, upgrade to CSV Field 3.0.7 [3] * If you use the CSV Field 2.0.x, upgrade to CSV Field 2.0.10 [4] CSV Field 1.0.x is no longer supported and does not receive security coverage. Sites still on 1.0.x should upgrade to a supported branch. Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Dima Storozhuk (dstorozhuk) [6] * Thomas Fleming (thomas.fleming) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/csv_field [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/csv_field/releases/3.0.7 [4] https://www.drupal.org/project/csv_field/releases/2.0.10 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/dstorozhuk [7] https://www.drupal.org/u/thomasfleming [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-225 Project: Custom Formatters [1] Project machine name: custom_formatters Date: 2026-October-21 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote code execution Affected versions: <4.2.1 CVE IDs: CVE-2026-114524 Description: The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval() to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about this behavior. Solution: Install the latest version: * If you use Custom Formatters, upgrade to Custom Formatters 4.2.1 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Stuart Clark (deciphered) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/custom_formatters [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/custom_formatters/releases/4.2.1 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/deciphered [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-224 Project: ABC [1] Project machine name: abc Date: 2026-October-21 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.25.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-114525 Description: The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted. Solution: Install the latest version: * If you use ABC 8.x-1.x, upgrade to ABC 8.x-1.25 [3]. * If you use ABC 2.0.x, upgrade to ABC 2.0.1 [4]. Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By: * Florian Radut (florian) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/abc [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/abc/releases/8.x-1.25 [4] https://www.drupal.org/project/abc/releases/2.0.1 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/florian [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-223 Project: Black Hole [1] Project machine name: black_hole Date: 2026-October-21 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.26.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-114526 Description: The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted. Solution: Install the latest version: * If you use Black Hole 8.x-1.x, upgrade to Black Hole 8.x-1.26 [3]. * If you use Black Hole 2.0.x, upgrade to Black Hole 2.0.1 [4]. Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By: * Florian Radut (florian) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/black_hole [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/black_hole/releases/8.x-1.26 [4] https://www.drupal.org/project/black_hole/releases/2.0.1 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/florian [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0