CVE-2026-87942
- Source
- https://cve.org/CVERecord?id=CVE-2026-87942
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87942.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-87942
- Aliases
- Published
- 2026-10-22T01:22:00Z
- Modified
- 2026-10-28T02:30:30Z
- Severity
-
- 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140
- Details
-
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.
- Database specific
{ "cna_assigner": "drupal", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87942.json" }- References
Affected packages
Git / git.drupalcode.org/project/safedelete
Affected ranges
- Type
- GIT
- Repo
- https://git.drupalcode.org/project/safedelete
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed02dfea087e6586ee091f3db37c4e6f90a853776a
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.0.0" }, { "fixed": "1.0.88" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }
Affected versions
1.*
1.0
1.0-alpha1
1.0.0
1.0.0-alpha1
1.0.0-alpha2
1.0.0-alpha3
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.19
1.0.2
1.0.20
1.0.21
1.0.22
1.0.23
1.0.24
1.0.25
1.0.26
1.0.29
1.0.3
1.0.30
1.0.31
1.0.32
1.0.33
1.0.34
1.0.35
1.0.36
1.0.37
1.0.38
1.0.39
1.0.4
1.0.40
1.0.41
1.0.42
1.0.43
1.0.45
1.0.46
1.0.47
1.0.48
1.0.5
1.0.52
1.0.53
1.0.54
1.0.55
1.0.56
1.0.56-rc1
1.0.57
1.0.58
1.0.59
1.0.6
1.0.60
1.0.61
1.0.62
1.0.63
1.0.64
1.0.65
1.0.66
1.0.67
1.0.68
1.0.69
1.0.7
1.0.70
1.0.71
1.0.72
1.0.73
1.0.74
1.0.75
1.0.76
1.0.77
1.0.78
1.0.79
1.0.80
1.0.81
1.0.82
1.0.83
1.0.84
1.0.85
1.0.86
1.0.87
1.0.9