View online: https://www.drupal.org/sa-core-2026-016 Project: Drupal core [1] Project machine name: drupal Date: 2026-July-13 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108514 Description:  The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission. Solution:  Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.10 [3]. * If you use Drupal 11.3.x, update to Drupal 11.3.19 [4]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.19 [5]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 [6] and Drupal 9 [7] have both reached end-of-life. Reported By:  * Eric Tee (erictee2802) [8] * haii haii (hai27ii2o) [9] Fixed By:  * Benji Fisher (benjifisher) [10] of the Drupal Security Team * Jürgen Haas (jurgenhaas) [11] * Lee Rowlands (larowlan) [12] of the Drupal Security Team * Mingsong (mingsong) [13] * Mohit Aghera (mohit_aghera) [14], provisional member of the Drupal Security Team * James Gilliland (neclimdul) [15] of the Drupal Security Team * Pablo López (plopesc) [16] * Juraj Nemec (poker10) [17] of the Drupal Security Team * Pierre Rudloff (prudloff) [18] of the Drupal Security Team Coordinated By:  * cilefen (cilefen) [19] of the Drupal Security Team * Lee Rowlands (larowlan) [20] of the Drupal Security Team * Dave Long (longwave) [21] of the Drupal Security Team * James Gilliland (neclimdul) [22] of the Drupal Security Team * Juraj Nemec (poker10) [23] of the Drupal Security Team * Pierre Rudloff (prudloff) [24] of the Drupal Security Team * Jess (xjm) [25] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [26] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/drupal/releases/11.4.10 [4] https://www.drupal.org/project/drupal/releases/11.3.19 [5] https://www.drupal.org/project/drupal/releases/10.6.19 [6] https://www.drupal.org/psa-2021-06-29 [7] https://www.drupal.org/psa-2023-11-01 [8] https://www.drupal.org/u/erictee2802 [9] https://www.drupal.org/u/hai27ii2o [10] https://www.drupal.org/u/benjifisher [11] https://www.drupal.org/u/jurgenhaas [12] https://www.drupal.org/u/larowlan [13] https://www.drupal.org/u/mingsong [14] https://www.drupal.org/u/mohit_aghera [15] https://www.drupal.org/u/neclimdul [16] https://www.drupal.org/u/plopesc [17] https://www.drupal.org/u/poker10 [18] https://www.drupal.org/u/prudloff [19] https://www.drupal.org/u/cilefen [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/u/longwave [22] https://www.drupal.org/u/neclimdul [23] https://www.drupal.org/u/poker10 [24] https://www.drupal.org/u/prudloff [25] https://www.drupal.org/u/xjm [26] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....