View online: https://www.drupal.org/sa-contrib-2026-094 Project: Entity Browser [1] Date: 2026-August-05 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Affected versions: <2.16.0 CVE IDs: CVE-2026-18986 Description: The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser. Solution: Install the latest version: * If you use the Entity Browser module, upgrade to Entity Browser 8.x-2.16 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Julian Pustkuchen (anybody) [5] * Sascha Grossenbacher (berdir) [6] * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/entity_browser [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_browser/releases/8.x-2.16 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/berdir [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....