Drupal Core Link Module Vulnerable to Moderately Critical Cross-Site Scripting
Drupal core's Link module contains a moderately critical cross-site scripting (XSS) vulnerability, CVE-2026-108515, due to insufficient sanitization of specific markup.
Drupal core has released security advisory SA-CORE-2026-015, detailing a moderately critical cross-site scripting (XSS) vulnerability affecting the Link module. This flaw, identified as CVE-2026-108515, arises from the module's failure to adequately sanitize certain markup under specific circumstances, potentially enabling attackers to inject malicious scripts into web pages.
The vulnerability impacts a range of Drupal versions, specifically those from 8.9.0 up to, but not including, 10.6.19, as well as versions 11.0.0 up to, but not including, 11.3.19, and 11.4.0 up to, but not including, 11.4.10. Additionally, versions 12.0.0-alpha1 through 12.0.0-beta2 are also affected. Drupal versions 10.5.x and below, along with Drupal 8 and Drupal 9, have reached their end-of-life and no longer receive security updates, leaving them exposed.
The Link module is a fundamental component of Drupal, providing a field type for managing both internal and external URLs. The vulnerability specifically targets how the module handles markup within these links, allowing for the injection of malicious code if certain conditions are met. This could lead to various XSS attack scenarios, such as session hijacking, credential theft, or defacement of websites.
Drupal security researchers have provided specific patch information for affected versions. Users running Drupal 11.4.x are advised to update to version 11.4.10. Those on Drupal 11.3.x should upgrade to 11.3.19. For Drupal 10 users, updating to version 10.6.19 is recommended. The advisory explicitly states that older versions of Drupal 11 and Drupal 10 are no longer supported and do not receive security coverage.
The vulnerability was reported by dev-winty and fixed by Benji Fisher and other members of the Drupal Security Team, including catch, David Cameron, Shawn Duncan, Lee Rowlands, Drew Webber, Mohit Aghera, and Jess. The coordinated disclosure and patching process involved several key individuals from the Drupal Security Team, ensuring a thorough and timely response.
This advisory highlights the ongoing need for vigilance in maintaining Drupal installations. Even seemingly minor modules can harbor critical vulnerabilities if not properly maintained and updated. The cross-site scripting nature of this flaw means that successful exploitation could have significant consequences for website administrators and their users, underscoring the importance of applying security patches promptly.
Organizations utilizing Drupal are urged to review their current versions and apply the necessary updates as soon as possible to mitigate the risk of exploitation. The Drupal Security Team's proactive approach in identifying and addressing such vulnerabilities is crucial for maintaining the security and integrity of the vast number of websites powered by the Drupal content management system.