Drupal Navigation Module Vulnerable to Cross-Site Scripting
Drupal core has released security advisory SA-CORE-2026-016, addressing a moderately critical cross-site scripting (XSS) vulnerability in the Navigation module.
Drupal core has issued a security advisory, SA-CORE-2026-016, detailing a moderately critical cross-site scripting (XSS) vulnerability within its Navigation module. The vulnerability, identified as CVE-2026-108514, arises from insufficient sanitization of specific attributes used in the module.
This flaw could potentially allow an attacker to inject malicious scripts into web pages viewed by other users. The severity is mitigated by the requirement that an attacker must possess specific permissions. These include the ability to enter HTML tags containing certain data attributes or the 'administer menu' permission, which limits the scope of potential exploitation to authenticated users with elevated privileges.
The affected versions of Drupal core include a range of releases within the 10.3.x, 11.0.x, and 11.4.x branches. Specifically, versions from 10.3.0 up to, but not including, 10.6.19 are vulnerable. Similarly, versions from 11.0.0 up to, but not including, 11.3.19, and versions from 11.4.0 up to, but not including, 11.4.10 are also impacted. Users running Drupal 12.0.0-alpha1 through 12.0.0-beta2 are also advised to update.
Drupal has provided specific patching instructions for users. Those on Drupal 11.4.x should update to version 11.4.10. For users on Drupal 11.3.x, the recommended update is to version 11.3.19. It is important to note that Drupal 11.2.x and earlier versions are considered end-of-life and no longer receive security support.
For users running Drupal 10, the advisory recommends updating to Drupal 10.6.19 if you are on the 10.6.x branch. Versions of Drupal 10.5.x and below are also end-of-life and do not receive security coverage. Users of Drupal 8 and Drupal 9 should be aware that both of these major versions have reached their end-of-life and are no longer supported.
The vulnerability was reported by Eric Tee and haii haii, with the fix being implemented by a team of Drupal Security Team members including Benji Fisher, Jürgen Haas, Lee Rowlands, Mingsong, Mohit Aghera, James Gilliland, Pablo López, Juraj Nemec, and Pierre Rudloff. The coordinated effort was managed by several key figures within the Drupal Security Team.
This XSS vulnerability, while rated moderately critical, underscores the ongoing need for diligent security practices within the Drupal ecosystem. Developers and site administrators are strongly encouraged to apply the provided updates promptly to protect their sites from potential exploitation, especially given the broad adoption of Drupal across various web platforms.