Drupal core – Moderately critical – Cross-site scripting – SA-CORE-2026-015

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108515Description: The Drupal core Link module provides a field type that can be used for internal and external URLs.
The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.Solution: Install the latest version:
Drupal 11

If you use Drupal 11.4.x, update to Drupal 11.4.10.
If you use Drupal 11.3.x, update to Drupal 11.3.19.
Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

If you use Drupal 10.6.x, update to Drupal 10.6.19.
Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.Reported By: 
dev-winty
Fixed By: 
Benji Fisher (benjifisher) of the Drupal Security Team
catch (catch) of the Drupal Security Team
David Cameron (dcam)
Shawn Duncan (fathershawn)
Lee Rowlands (larowlan) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
Jess (xjm) of the Drupal Security Team
Coordinated By: 
Swan Kalata (akalata) of the Drupal Security Team
Benji Fisher (benjifisher) of the Drupal Security Team
Neil Drumm (drumm) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Dave Long (longwave) of the Drupal Security Team
James Gilliland (neclimdul) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Ra Mänd (ram4nd), provisional member of the Drupal Security
Jess (xjm) of the Drupal Security TeamSecurity advisoriesRead More