DRUPAL-CORE-2026-016

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/core/DRUPAL-CORE-2026-016.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CORE-2026-016
Aliases
  • CVE-2026-108514
Published
2026-10-14T17:25:38Z
Modified
2026-10-14T18:00:02Z
Summary
[none]
Details

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

References
Credits

Affected packages

Packagist / drupal/core

Package

Name
drupal/core
Purl
pkg:composer/drupal/core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.3.0
Fixed
10.6.19
Database specific
Show details 
{
    "constraint":  ">= 10.3.0 < 10.6.19"
}
Type
ECOSYSTEM
Events
Introduced
11.0.0
Fixed
11.3.19
Database specific
Show details 
{
    "constraint":  ">= 11.0.0 < 11.3.19"
}
Type
ECOSYSTEM
Events
Introduced
11.4.0
Fixed
11.4.10
Database specific
Show details 
{
    "constraint":  ">= 11.4.0 < 11.4.10"
}
Type
ECOSYSTEM
Events
Introduced
12.0.0-alpha1
Fixed
12.0.0-beta2
Database specific
Show details 
{
    "constraint":  ">= 12.0.0-alpha1 < 12.0.0-beta2"
}

Affected versions

10.*
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.3.7
10.3.8
10.3.9
10.3.10
10.3.11
10.3.12
10.3.13
10.3.14
10.4.0-beta1
10.4.0-rc1
10.4.0
10.4.1
10.4.2
10.4.3
10.4.4
10.4.5
10.4.6
10.4.7
10.4.8
10.4.9
10.4.10
10.5.0-beta1
10.5.0-rc1
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
10.5.6
10.5.7
10.5.8
10.5.9
10.5.10
10.5.11
10.5.12
10.6.0-beta1
10.6.0-rc1
10.6.0
10.6.1
10.6.2
10.6.3
10.6.4
10.6.5
10.6.6
10.6.7
10.6.8
10.6.9
10.6.10
10.6.11
10.6.12
10.6.13
10.6.14
10.6.15
10.6.16
10.6.17
10.6.18
11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.0.10
11.0.11
11.0.12
11.0.13
11.1.0-beta1
11.1.0-rc1
11.1.0
11.1.1
11.1.2
11.1.3
11.1.4
11.1.5
11.1.6
11.1.7
11.1.8
11.1.9
11.1.10
11.2.0-alpha1
11.2.0-beta1
11.2.0-rc1
11.2.0-rc2
11.2.0
11.2.1
11.2.2
11.2.3
11.2.4
11.2.5
11.2.6
11.2.7
11.2.8
11.2.9
11.2.10
11.2.11
11.2.12
11.2.13
11.2.14
11.3.0-alpha1
11.3.0-beta1
11.3.0-rc1
11.3.0-rc2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
11.3.9
11.3.10
11.3.11
11.3.12
11.3.13
11.3.14
11.3.16
11.3.17
11.3.18
11.4.0
11.4.1
11.4.2
11.4.3
11.4.4
11.4.5
11.4.6
11.4.7
11.4.8
11.4.9
12.*
12.0.0-alpha1
12.0.0-beta1

Database specific

affected_versions 
">= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/core/DRUPAL-CORE-2026-016.json"