Drupal Core Cross-Site Scripting (XSS)

MEDIUM 5.4CVE-2024-12393 · BIT-drupal-2024-12393 · DRUPAL-CORE-2024-003 · Published 10/12/2024 · updated 17/06/2026

In short

CVE-2024-12393 is a MEDIUM (CVSS 5.4) vulnerability affecting drupal/core, drupal/core-recommended, drupal/drupal.
Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 27.1% of all vulnerabilities.
Fix: update to 10.3.9, 11.0.8, 10.2.11 or later.

Package	Affected versions	Patched versions
drupal/core Packagist	`≥ 10.3.0, < 10.3.9≥ 11.0.0, < 11.0.8≥ 8.8.0, < 10.2.11`	`10.3.911.0.810.2.11`
drupal/core-recommended Packagist	`≥ 10.3.0, < 10.3.9≥ 11.0.0, < 11.0.8≥ 8.8.0, < 10.2.11`	`10.3.911.0.810.2.11`
drupal/drupal Packagist	`≥ 10.3.0, < 10.3.9≥ 11.0.0, < 11.0.8≥ 8.8.0, < 10.2.11`	`10.3.911.0.810.2.11`
drupal drupal	`≥ 10.3.0, < 10.3.9≥ 11.0.0, < 11.0.8≥ 8.8.0, < 10.2.11`	`10.3.911.0.810.2.11`

Description

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

NVD description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.