| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 10.3.0, < 10.6.19≥ 11.0.0, < 11.3.19≥ 11.4.0, < 11.4.10≥ 12.0.0-alpha1, < 12.0.0-beta2 | 10.6.1911.3.1911.4.1012.0.0-beta2 |
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free