View online: https://www.drupal.org/sa-core-2026-015 Project: Drupal core [1] Project machine name: drupal Date: 2026-September-17 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description:  The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities. Solution:  Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.10 [3]. * If you use Drupal 11.3.x, update to Drupal 11.3.19 [4]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.19 [5]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 [6] and Drupal 9 [7] have both reached end-of-life. Reported By:  * dev-winty [8] Fixed By:  * Benji Fisher (benjifisher) [9] of the Drupal Security Team * catch (catch) [10] of the Drupal Security Team * David Cameron (dcam) [11] * Shawn Duncan (fathershawn) [12] * Lee Rowlands (larowlan) [13] of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [15], provisional member of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team Coordinated By:  * Swan Kalata (akalata) [17] of the Drupal Security Team * Benji Fisher (benjifisher) [18] of the Drupal Security Team * Neil Drumm (drumm) [19] of the Drupal Security Team * Greg Knaddison (greggles) [20] of the Drupal Security Team * Dave Long (longwave) [21] of the Drupal Security Team * James Gilliland (neclimdul) [22] of the Drupal Security Team * Juraj Nemec (poker10) [23] of the Drupal Security Team * Ra Mänd (ram4nd) [24] * Jess (xjm) [25] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [26] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/drupal/releases/11.4.10 [4] https://www.drupal.org/project/drupal/releases/11.3.19 [5] https://www.drupal.org/project/drupal/releases/10.6.19 [6] https://www.drupal.org/psa-2021-06-29 [7] https://www.drupal.org/psa-2023-11-01 [8] https://www.drupal.org/u/dev-winty [9] https://www.drupal.org/u/benjifisher [10] https://www.drupal.org/u/catch [11] https://www.drupal.org/u/dcam [12] https://www.drupal.org/u/fathershawn [13] https://www.drupal.org/u/larowlan [14] https://www.drupal.org/u/mcdruid [15] https://www.drupal.org/u/mohit_aghera [16] https://www.drupal.org/u/xjm [17] https://www.drupal.org/u/akalata [18] https://www.drupal.org/u/benjifisher [19] https://www.drupal.org/u/drumm [20] https://www.drupal.org/u/greggles [21] https://www.drupal.org/u/longwave [22] https://www.drupal.org/u/neclimdul [23] https://www.drupal.org/u/poker10 [24] https://www.drupal.org/u/ram4nd [25] https://www.drupal.org/u/xjm [26] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....