- Security-news - lists.drupal.org

Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-079 Project: Commerce guest registration [1] Date: 2026-July-08 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-15089 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/commerce_guest_registration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-078 Project: Clean RESTful [1] Date: 2026-July-08 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-15087 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/clean_node_api [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-077 Project: Raw Formatter [Meta Tag Formatter] [1] Date: 2026-July-08 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-15086 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/raw_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-076 Project: AI SEO/GEO Analyzer [1] Date: 2026-July-08 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site Scripting Affected versions: <1.1.3 CVE IDs: CVE-2026-15085 Description: The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comments) to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users. The generated HTML was rendered without passing through Drupal's filtering pipeline, so it relied on the LLM output being safe. Under certain circumstances a crafted prompt injection — planted in content that is included in the analysis — can cause the LLM to emit markup that results in stored Cross-site Scripting when the report is later viewed. This vulnerability is mitigated by the fact that an attacker must be able to inject text into the content that is sent to the LLM, and that prompt injection is non-deterministic and not guaranteed to succeed on a given attempt. Solution: Install the latest version: * If you use the AI SEO/GEO Analyzer module 1.1.x, upgrade to ai_seo 1.1.3 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Juhani Väätäjä (j-vee) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185231-ai_seo-security/-/work_items/1 [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/ai_seo [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_seo/releases/1.1.3 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/j-vee [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://git.drupalcode.org/security/185231-ai_seo-security/-/work_items/1 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-075 Project: UI Patterns (SDC in Drupal UI) [1] Date: 2026-July-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <2.0.17 CVE IDs: CVE-2026-15084 Description: This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC. The module doesn't sufficiently sanitize the markup passed to components under certain scenarios. This vulnerability is mitigated by the fact that an attacker must be able to create or update content rendered by UI Patterns. Solution: Install the latest version: * If you use the UI Patterns module on version 2, upgrade to UI Patterns 2.0.17 [3] Reported By: * Hervé Donner (herved) [4] Fixed By: * Florent Torregrosa (grimreaper) [5] * Hervé Donner (herved) [6] * Mikael Meulle (just_like_good_vibes) [7] * Pierre Dureau (pdureau) [8] Coordinated By: * Neil Drumm (drumm) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Dave Long (longwave) [12] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185300-ui_patterns-security/-/work_item… [13] ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/ui_patterns [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ui_patterns/releases/2.0.17 [4] https://www.drupal.org/u/herved [5] https://www.drupal.org/u/grimreaper [6] https://www.drupal.org/u/herved [7] https://www.drupal.org/u/just_like_good_vibes [8] https://www.drupal.org/u/pdureau [9] https://www.drupal.org/u/drumm [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/longwave [13] https://git.drupalcode.org/security/185300-ui_patterns-security/-/work_item… [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-074 Project: ECA: Event - Condition - Action [1] Date: 2026-July-08 Security risk: *Less critical* 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.1.20 || >=3.0.0 <3.0.12 || >=3.1.0 <3.1.4 CVE IDs: CVE-2026-15083 Description: The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is mitigated by the fact that a site must be running an ECA model that uses the "Render: Twig" action on a data flow. Solution: Install the latest version: * If you use the ECA 3.1 for Drupal 10.x or 11.x, upgrade to ECA 3.1.4 [3] * If you use the ECA 3.0 for Drupal 10.x or 11.x, upgrade to ECA 3.0.12 [4] * If you use the ECA 1.2 for Drupal 10.x or 11.x, upgrade to ECA 2.1.20 [5] Reported By: * Changhai Qi (qichanghai) [6] Fixed By: * Jürgen Haas (jurgenhaas) [7] Coordinated By: * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3590327-eca-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/eca [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3609312 [4] https://www.drupal.org/node/3609311 [5] https://www.drupal.org/node/3609310 [6] https://www.drupal.org/u/qichanghai [7] https://www.drupal.org/u/jurgenhaas [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/longwave [11] https://git.drupalcode.org/security/3590327-eca-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-073 Project: Siteimprove Analytics [1] Date: 2026-July-08 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: <2.0.1 CVE IDs: CVE-2026-15082 Description: The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer siteimprove_analytics". Solution: Install the latest version: * If you use the siteimprove_analytics module for Drupal verision prior 10.3, upgrade to siteimprove_analytics 2.0.1 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Bohdan Artemchuk (bohart) [5] * Andriy Parkhomiuk (grask0) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/siteimprove_analytics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/siteimprove_analytics/releases/2.0.1 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/bohart [6] https://www.drupal.org/u/grask0 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/prudloff [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-072 Project: Location Selector [1] Date: 2026-July-08 Security risk: *Critical* 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: SQL Injection Affected versions: <1.3.0 CVE IDs: CVE-2026-15081 Description: The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist that uses the affected filter and is configured to accept user input. Solution: Install the latest version: * If you use the Location Selector module for Drupal, upgrade to Location Selector 8.x-1.3 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * handkerchief [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185258-location_selector-security/-/wor… [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/location_selector [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/location_selector/releases/8.x-1.3 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/handkerchief [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/poker10 [9] https://git.drupalcode.org/security/185258-location_selector-security/-/wor… [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-071 Project: Ray Enterprise Translation [1] Date: 2026-July-08 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site request forgery Affected versions: <4.0.4 || >=4.1.0 <4.1.4 || >=11.0.0 <11.0.4 CVE IDs: CVE-2026-15080 Description: The Lingotek Ray Enterprise Translation provides multilingual site management. The module fails to protect several state-changing administrative routes against Cross Site Request Forgery attacks. An attacker could trick a privileged user into visiting a crafted page that triggers actions such as updating callback settings, uploading or downloading translations, or changing translation state. Solution: Install the latest version appropriate for your site * If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 11.0.4 [3] * If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 4.1.4 [4] * If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 4.0.4 [5] Reported By: * Pierre Rudloff (prudloff) [6] of the Drupal Security Team Fixed By: * Naresh Bavaskar (naresh_bavaskar) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/lingotek [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/lingotek/releases/11.0.4 [4] https://www.drupal.org/project/lingotek/releases/4.1.4 [5] https://www.drupal.org//www.drupal.org/project/lingotek/releases/4.0.4 [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/naresh_bavaskar [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070
by security-news＠drupal.org 08 Jul '26

08 Jul '26

View online: https://www.drupal.org/sa-contrib-2026-070 Project: Login Disable [1] Date: 2026-July-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.4 CVE IDs: CVE-2026-15079 Description: The Login Disable module prevents users from logging in to your Drupal site unless they know the secret key to add to the end of the login form page. The module doesn't sufficiently protect the disabled login form from brute force attacks. Depending on the length of the key this could allow an attacker to use a brute force attack to bypass the protection provided by this module. The security fix blocks these attempts with flood control. This vulnerability is mitigated by the fact that an attacker must obtain a valid username & password. Solution: Install the latest version: * If you use the Login Disable module, upgrade to Login Disable 2.1.4 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Boris Doesborg (batigolix) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/login_disable [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/login_disable/releases/2.1.4 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/batigolix [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/prudloff [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0