Drupal core allows Cross-Site Scripting (XSS)

MEDIUM 6.1CVE-2026-6367 · BIT-drupal-2026-6367 · DRUPAL-CORE-2026-003 · Published 19/05/2026 · updated 24/07/2026

Package	Affected versions	Patched versions
drupal/core Packagist	`≥ 11.3.0, < 11.3.7`	`11.3.7`
drupal drupal	`≥ 11.3.0, < 11.3.7`	`11.3.7`

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).

This issue affects Drupal core: from 11.3.0 before 11.3.7.

NVD description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

References

nvd.nist.gov/vuln/detail/CVE-2026-6367 · ADVISORY
drupal/core · PACKAGE
drupal.org/sa-core-2026-003 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free