Drupal core – Moderately critical – Cross-site scripting – SA-CORE-2026-016

October 14, 2026 Yanac

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108514Description: The Navigation module doesn’t sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.Solution: Install the latest version:
Drupal 11

If you use Drupal 11.4.x, update to Drupal 11.4.10.
If you use Drupal 11.3.x, update to Drupal 11.3.19.
Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

If you use Drupal 10.6.x, update to Drupal 10.6.19.
Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.Reported By:
Eric Tee (erictee2802)
haii haii (hai27ii2o)
Fixed By:
Benji Fisher (benjifisher) of the Drupal Security Team
Jürgen Haas (jurgenhaas)
Lee Rowlands (larowlan) of the Drupal Security Team
Mingsong (mingsong), provisional member of the Drupal Security
Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
James Gilliland (neclimdul) of the Drupal Security Team
Pablo López (plopesc)
Juraj Nemec (poker10) of the Drupal Security Team
Pierre Rudloff (prudloff) of the Drupal Security Team
Coordinated By:
cilefen (cilefen) of the Drupal Security Team
Lee Rowlands (larowlan) of the Drupal Security Team
Dave Long (longwave) of the Drupal Security Team
James Gilliland (neclimdul) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Pierre Rudloff (prudloff) of the Drupal Security Team
Jess (xjm) of the Drupal Security TeamSecurity advisoriesRead More