DRUPAL-CONTRIB-2026-073

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/siteimprove_analytics/DRUPAL-CONTRIB-2026-073.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-073

Aliases

CVE-2026-15082

Published

2026-07-08T17:15:18Z

Modified

2026-09-10T03:46:13Z

Summary

[none]

Details

The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting (XSS).

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer siteimprove_analytics".

References

https://www.drupal.org/sa-contrib-2026-073

Credits

- Pierre Rudloff (prudloff)
- - https://www.drupal.org/u/prudloff

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/siteimprove_analytics

Package

Name: drupal/siteimprove_analytics
Purl: pkg:composer/drupal/siteimprove_analytics?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

2.0.1

Database specific

Show details

{
    "constraint": "<2.0.1"
}

Database specific

affected_versions

"<2.0.1"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/siteimprove_analytics/DRUPAL-CONTRIB-2026-073.json"