- Security-news - lists.drupal.org

Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043
by security-news＠drupal.org 10 Jun '26

10 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-043 Project: Tagify [1] Date: 2026-June-10 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting (XSS) Affected versions: <1.2.52 CVE IDs: CVE-2026-11908 Description: This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets. The module does not properly sanitise the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the user’s session. The vulnerability is mitigated by the fact an attacker must have a role with permission to create or edit taxonomy terms in a vocabulary. Solution: Install the latest version of the Tagify module that includes a fix for sanitising parent term names in the Tagify dropdown rendering. * If you use the Tagify module for Drupal, upgrade to tagify 1.2.52 [3]. More information will be provided in the project release notes once the fixed version is published. Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * David Galeano (gxleano) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Dave Long (longwave) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185106-tagify-security/-/work_items/1 [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/tagify [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tagify/releases/1.2.52 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/gxleano [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/longwave [8] https://www.drupal.org/u/prudloff [9] https://git.drupalcode.org/security/185106-tagify-security/-/work_items/1 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042
by security-news＠drupal.org 03 Jun '26

03 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-042 Project: Anti-Spam by CleanTalk [1] Date: 2026-June-03 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Affected versions: <9.7.1 CVE IDs: CVE-2026-10770 Description: This module provides spam protection using the CleanTalk cloud service. The module doesn't sufficiently sanitize API response messages before rendering them in HTML output. The _cleantalk_die() and ct_die() functions output the CleanTalk API response message directly into HTML without proper sanitization, allowing potential injection of arbitrary HTML or JavaScript. This vulnerability is mitigated by the fact that an attacker must be able to influence the CleanTalk cloud API response (e.g., through a man-in-the-middle attack or a compromised API server). Solution: Install the latest version: * If you use the Anti-Spam by CleanTalk module for Drupal upgrade to Anti-Spam by CleanTalk 9.7.1 [3] Reported By: * Ra Mänd (ram4nd) [4] provisional member of the Drupal Security Team Fixed By: * alexandergull [5] * anton1211 [6] * Ra Mänd (ram4nd) [7] provisional member of the Drupal Security Team Coordinated By: * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185105-cleantalk-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/cleantalk [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cleantalk/releases/9.7.1 [4] https://www.drupal.org/u/ram4nd [5] https://www.drupal.org/u/alexandergull [6] https://www.drupal.org/u/anton1211 [7] https://www.drupal.org/u/ram4nd [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://git.drupalcode.org/security/185105-cleantalk-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041
by security-news＠drupal.org 03 Jun '26

03 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-041 Project: Commerce Core [1] Date: 2026-June-03 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Affected versions: >= 3.3.0 < 3.3.6 CVE IDs: CVE-2026-10769 Description: The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting (XSS). This vulnerability is mitigated by the fact that it only affects installations with Checkout (commerce_checkout) enabled, and the "Comments" checkout pane (id: customer_comments) is explicitly used, which is disabled by default. Solution: Install the latest version: * If you use Commerce Core 3.3.x, upgrade to Commerce Core 3.3.6 [3] Reported By: * Brian Willows (hsjbrianwillows) [4] Fixed By: * Jonathan Sacksick (jsacksick) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Lee Rowlands (larowlan) [7] of the Drupal Security Team * Dave Long (longwave) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185078-commerce-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce/releases/3.3.6 [4] https://www.drupal.org/u/hsjbrianwillows [5] https://www.drupal.org/u/jsacksick [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/longwave [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185078-commerce-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

TacJS - Moderately critical - Improper Access Control - SA-CONTRIB-2026-040
by security-news＠drupal.org 03 Jun '26

03 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-040 Project: TacJS [1] Date: 2026-June-03 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Improper Access Control Affected versions: <6.8 CVE IDs: CVE-2026-49977 Description: This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to an attacker being able to delete arbitrary cookies. This vulnerability is mitigated by the fact that an attacker needs to be able to insert specific data attributes in the page. Solution: Install the latest version: * If you use tacjs 8.x-6.x, upgrade to tacjs 8.x-6.8 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185107-tacjs-security/-/work_items/1 [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/tacjs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tacjs/releases/8.x-6.8 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/prudloff [8] https://git.drupalcode.org/security/185107-tacjs-security/-/work_items/1 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039
by security-news＠drupal.org 03 Jun '26

03 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-039 Project: LocalGov Workflows [1] Date: 2026-June-03 Security risk: *Moderately critical* 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Affected versions: <1.6.0 CVE IDs: CVE-2026-10768 Description: This module configures default editorial workflows for LocalGov Drupal content types. It provides a Drupal content moderation workflow, a content approvals dashboard, content scheduling and content preview. The module doesn't sufficiently restrict access to a view of Service Contacts at which exposes the names and content items assigned to each Service Contact. Solution: Install the latest version: * If you use the LocalGov Workflows module for Drupal, upgrade to LocalGov Workflows 1.6.0 [3] Reported By: * Maria Young (maria.y) [4] Fixed By: * Finn Lewis (finn lewis) [5] * Rupert Jabelman (rupertj) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Dave Long (longwave) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185130-localgov_workflows-security/-/wo… [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/localgov_workflows [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/localgov_workflows/releases/1.6.0 [4] https://www.drupal.org/u/mariay-0 [5] https://www.drupal.org/u/finn-lewis [6] https://www.drupal.org/u/rupertj [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/longwave [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185130-localgov_workflows-security/-/wo… [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
by security-news＠drupal.org 27 May '26

27 May '26

View online: https://www.drupal.org/sa-contrib-2026-038 Project: Drupal AlternativeCommerce (Basket) [1] Date: 2026-May-27 Security risk: *Highly critical* 22 ∕ 25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Arbitrary PHP code execution Affected versions: <2.1.17 CVE IDs: CVE-2026-9726 Description: The Basket module enables e-commerce and checkout functionality for Drupal sites. The module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize(). An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution. Solution: Install the latest version: * If you use the Basket module, upgrade to Basket 2.1.17. Reported By: * Drew Webber (mcdruid) [3] of the Drupal Security Team Fixed By: * Helena Zajika (helena zajika) [4] * Drew Webber (mcdruid) [5] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Dave Long (longwave) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185185-basket-security/-/work_items/1 [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/basket [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/u/mcdruid [4] https://www.drupal.org/u/helena-zajika [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/longwave [8] https://www.drupal.org/u/mcdruid [9] https://git.drupalcode.org/security/185185-basket-security/-/work_items/1 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
by security-news＠drupal.org 20 May '26

20 May '26

View online: https://www.drupal.org/sa-core-2026-004 Project: Drupal core [1] Date: 2026-May-20 Security risk: *Highly critical* 20 ∕ 25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: SQL injection Affected versions: >= 8.9.0 < 10.4.10 || >= 10.5.0 < 10.5.10 || >= 10.6.0 < 10.6.9 || >= 11.0.0 < 11.1.10 || >= 11.2.0 < 11.2.12 || >= 11.3.0 < 11.3.10 CVE IDs: CVE-2026-9082 Description: Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases. This can lead to information disclosure, and in some cases privilege escalation, remote code execution, or other attacks. This vulnerability can be exploited by anonymous users. This vulnerability *only affects sites using PostgreSQL*. However, the dependency updates in this release apply to all sites. .... Upstream security advisories The Drupal releases for supported branches (11.3, 11.2, 10.6, and 10.5) in this advisory also include security updates for Symfony and Twig. Those projects have released important Security Advisories [3] that were coordinated with this Drupal release, and Drupal is affected by some of the vulnerabilities. Depending on your site configuration and contrib modules, you may be vulnerable to one or more of these upstream issues, so *updating these dependencies is highly recommended whether the SQL Injection vulnerability affects you or not*. It is also recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules. Solution: Install the latest version. *The following releases will be available as soon as automated release packaging is complete.* You may receive a 404 in the interim. The updates may also be available on Packagist sooner. .. Drupal 11 * If you use Drupal 11.3.x, update to Drupal 11.3.10 [4]. * If you use Drupal 11.2.x, update to Drupal 11.2.12 [5]. * If you use Drupal 11.1.x or 11.0.x, update to Drupal 11.1.10 [6]. .. Drupal 10 * If you use Drupal 10.6.x, update to Drupal 10.6.9 [7]. * If you use Drupal 10.5.x, update to Drupal 10.5.10 [8]. * If you use Drupal 10.4.x or earlier, update to Drupal 10.4.10 [9]. .. Drupal 9 and 8 * If you use any version of Drupal 9, try manually applying the Drupal 9.5 patch for this issue [10]. * If you use Drupal 8.9, try manually applying the Drupal 8.9 patch for this issue [11]. Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 [12] and Drupal 9 [13] have both reached end-of-life.) Due to this issue's severity, the unsupported releases and patches for unsupported versions are provided as a best effort. Those unsupported versions /will/ still have other, previously disclosed security vulnerabilities. Reported By: * Michael Maturi (michaelmaturi) [14] Fixed By: * Björn Brala (bbrala) [15] * Benji Fisher (benjifisher) [16] of the Drupal Security Team * catch (catch) [17] of the Drupal Security Team * Lee Rowlands (larowlan) [18] of the Drupal Security Team * Dave Long (longwave) [19] of the Drupal Security Team * Drew Webber (mcdruid) [20] of the Drupal Security Team * Jess (xjm) [21] of the Drupal Security Team Coordinated By: * Anna Kalata (akalata) [22] of the Drupal Security Team * Benji Fisher (benjifisher) [23] of the Drupal Security Team * catch (catch) [24] of the Drupal Security Team * Damien McKenna (damienmckenna) [25] of the Drupal Security Team * Neil Drumm (drumm) [26] of the Drupal Security Team * Greg Knaddison (greggles) [27] of the Drupal Security Team * Heine Deelstra (heine) [28] of the Drupal Security Team * Tim Hestenes Lehnen (hestenet) [29] * Dave Long (longwave) [30] of the Drupal Security Team * Drew Webber (mcdruid) [31] of the Drupal Security Team * Juraj Nemec (poker10) [32] of the Drupal Security Team * Pierre Rudloff (prudloff) [33] of the Drupal Security Team * Jess (xjm) [34] of the Drupal Security Team * Cathy Theys (yesct) [35] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185145-drupal-security/-/work_items/1 [36] ------------------------------------------------------------------------------ Contribution record [37] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://symfony.com/blog/category/security-advisories [4] https://www.drupal.org/project/drupal/releases/11.3.10 [5] https://www.drupal.org/project/drupal/releases/11.2.12 [6] https://www.drupal.org/project/drupal/releases/11.1.10 [7] https://www.drupal.org/project/drupal/releases/10.6.9 [8] https://www.drupal.org/project/drupal/releases/10.5.10 [9] https://www.drupal.org/project/drupal/releases/10.4.10 [10] https://www.drupal.org/files/issues/2026-05-20/SA-CORE-2026-004-9.5.patch [11] https://www.drupal.org/files/issues/2026-05-20/SA-CORE-2026-004-8.9.patch [12] https://www.drupal.org/psa-2021-06-29 [13] https://www.drupal.org/psa-2023-11-01 [14] https://www.drupal.org/u/michaelmaturi [15] https://www.drupal.org/u/bbrala [16] https://www.drupal.org/u/benjifisher [17] https://www.drupal.org/u/catch [18] https://www.drupal.org/u/larowlan [19] https://www.drupal.org/u/longwave [20] https://www.drupal.org/u/mcdruid [21] https://www.drupal.org/u/xjm [22] https://www.drupal.org/u/akalata [23] https://www.drupal.org/u/benjifisher [24] https://www.drupal.org/u/catch [25] https://www.drupal.org/u/damienmckenna [26] https://www.drupal.org/u/drumm [27] https://www.drupal.org/u/greggles [28] https://www.drupal.org/u/heine [29] https://www.drupal.org/u/hestenet [30] https://www.drupal.org/u/longwave [31] https://www.drupal.org/u/mcdruid [32] https://www.drupal.org/u/poker10 [33] https://www.drupal.org/u/prudloff [34] https://www.drupal.org/u/xjm [35] https://www.drupal.org/u/yesct [36] https://git.drupalcode.org/security/185145-drupal-security/-/work_items/1 [37] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18
by security-news＠drupal.org 18 May '26

18 May '26

View online: https://www.drupal.org/psa-2026-05-18 Date: 2026-May-18 Description: There will be a *Drupal core security release for all supported branches on May 20, 2026, between 17:00 and 21:00 UTC*. (To see this in your local timezone, refer to the Drupal Core Calendar [1].) The Drupal Security Team urges you to reserve time for core updates at that time because exploits /might/ be developed within hours or days. The risk is currently rated as: Highly critical 20 ∕ 25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon. Not all configurations are affected. Reserve time on May 20 during the release window to determine whether your sites are affected and in need of an immediate update. Mitigation information will be included in the advisory. *We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before May 20*, so that you can address any other upgrade issues before the security window. (Recommendations for specific Drupal versions follow.) This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from known attack vectors, but should upgrade in the near future in case additional attack vectors are discovered. .... Affected versions .. Supported core versions Security releases will be provided for all the currently supported branches of Drupal core, which are: * 11.3.x * 11.2.x * 10.6.x * 10.5.x Sites on one of these supported versions should update to the latest patch release for the given branch /now/ in preparation for the security window. .. End-of-life minor core versions (Drupal 10 and 11) While the Drupal Security Team does not normally provide security releases for unsupported releases [2], given the severity of the issue, we /are/ providing 11.1.x and 10.4.x releases that include the fix for sites which have not yet had a chance to update. Therefore, in advance of the window: * Sites on Drupal 11.1 or 11.0 should update to at least Drupal 11.1.9 in preparation for the window. * Sites on Drupal 10.4, 10.3, 10.2, 10.1, or 10.0 should update to at least Drupal 10.4.9 in preparation for the window. These sites should apply the security update as soon as it is released on May 20, then plan to update to Drupal 11.3 or 10.6 in the near future. (Two other recent security advisories, SA-CORE-2026-001 [3] and SA-CORE-2026-002 [4], will /not/ be addressed for 11.1 or 10.4.) .. End-of-life major core versions (Drupal 8 and 9) These major versions are fully end-of-life, so no releases will be created for these branches. However, given the potential severity of this issue, *we will provide patch files for Drupal 8.9 and 9.5*. These patches must be applied manually. They are /not/ guaranteed to work correctly, and might introduce other bugs or regressions. However, they may help mitigate the vulnerability for sites still on these old major versions until they upgrade to a supported release. For the best chance of the patches being applied successfully: * Sites on any version of Drupal 9 should update to Drupal 9.5.11 in preparation for the window. * Sites on any version of Drupal 8 should update to Drupal 8.9.20 in preparation for the window. We strongly recommend Drupal 8 or 9 sites update to at least Drupal 10.6 soon. Drupal 8 and 9 include numerous other, previously disclosed security vulnerabilities that will not be addressed by either Drupal Steward or the best-effort patch files. Drupal 7 is not affected. .... Disclosure policy Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. The announcement will be made public at https://www.drupal.org/security [5], on Bluesky [6], Mastodon [7], X (formerly Twitter) [8], and LinkedIn [9], and in email for those who have subscribed to our email list. To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab. Security release announcements will appear on the Drupal.org security advisory page [10] which also has RSS feeds. Coordinated By: * Benji Fisher (benjifisher) [11] of the Drupal Security Team * catch (catch) [12] of the Drupal Security Team * cilefen (cilefen) [13] of the Drupal Security Team * Damien McKenna (damienmckenna) [14] of the Drupal Security Team * Neil Drumm (drumm) [15] of the Drupal Security Team * Greg Knaddison (greggles) [16] of the Drupal Security Team * Tim Hestenes Lehnen (hestenet) [17] * Lee Rowlands (larowlan) [18] of the Drupal Security Team * Dave Long (longwave) [19] of the Drupal Security Team * Drew Webber (mcdruid) [20] of the Drupal Security Team * Juraj Nemec (poker10) [21] of the Drupal Security Team * Jess (xjm) [22] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [23] [1] https://calendar.google.com/calendar/r?cid=drupalcorecalendar@association.d… [2] https://www.drupal.org/core/release-cycle-overview [3] https://www.drupal.org/sa-core-2026-001 [4] https://www.drupal.org/sa-core-2026-002 [5] https://www.drupal.org/security [6] https://bsky.app/profile/drupalsecurity.bsky.social [7] https://drupal.community/@drupalsecurity [8] https://x.com/drupalsecurity [9] https://www.linkedin.com/showcase/drupal-security-team/ [10] https://www.drupal.org/security [11] https://www.drupal.org/u/benjifisher [12] https://www.drupal.org/u/catch [13] https://www.drupal.org/u/cilefen [14] https://www.drupal.org/u/damienmckenna [15] https://www.drupal.org/u/drumm [16] https://www.drupal.org/u/greggles [17] https://www.drupal.org/u/hestenet [18] https://www.drupal.org/u/larowlan [19] https://www.drupal.org/u/longwave [20] https://www.drupal.org/u/mcdruid [21] https://www.drupal.org/u/poker10 [22] https://www.drupal.org/u/xjm [23] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037
by security-news＠drupal.org 13 May '26

13 May '26

View online: https://www.drupal.org/sa-contrib-2026-037 Project: Date iCal [1] Date: 2026-May-13 Security risk: *Critical* 17 ∕ 25 AC:None/A:None/CI:All/II:None/E:Theoretical/TD:All [2] Vulnerability: Information disclosure Affected versions: <4.0.15 CVE IDs: CVE-2026-8495 Description: This module enables you to export entity date fields as iCal feeds. The module doesn't sufficiently check entity or field access or sanitize user inputs when generating iCal feeds. This vulnerability is not mitigated by any permission, the routes are accessible to all anonymous users with no configuration required. Solution: Install the latest version: * If you use the Date iCal module for Drupal 10/11, upgrade to Date iCal 4.0.15 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Joël Pittet (joelpittet) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Dave Long (longwave) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/38-date_ical-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/date_ical [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/date_ical/releases/4.0.15 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/joelpittet [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/longwave [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/mcdruid [10] https://git.drupalcode.org/security/38-date_ical-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036
by security-news＠drupal.org 13 May '26

13 May '26

View online: https://www.drupal.org/sa-contrib-2026-036 Project: Colorbox Inline [1] Date: 2026-May-13 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <2.1.1 CVE IDs: CVE-2026-8493 Description: This module enables you to open content already on the page within a colorbox. The module doesn't sufficiently sanitize the data-colorbox-inline attribute value before passing it to jQuery, leading to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes. Solution: Install the latest version: * If you use the Colorbox Inline module for Drupal 8.x, upgrade to Colorbox Inline 2.1.1 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Michael Harris (miwayha) [5] Coordinated By: * Bram Driesen (bramdriesen) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185156-colorbox_inline-security/-/work_… [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/colorbox_inline [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/colorbox_inline/releases/2.1.1 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/miwayha [6] https://www.drupal.org/u/bramdriesen [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff [9] https://git.drupalcode.org/security/185156-colorbox_inline-security/-/work_… [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0