← 返回速览 继续信流 搜索
Aggregate Drupal.org Planet Drupal 15 Oct 2026 - 03:05

Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

RSS 官方收录 · 可信分层展示

关键摘要

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 10.…

  • 19 || >= 11.
  • 10 || >= 12.
  • 0-alpha1 < 12.

规则摘要 · 来源可核验

正文提要

Project: 
Drupal core
Project machine name: 
drupal
Date: 
2026-October-14
Security risk: 
Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: 
Cross-site scripting
Affected versions: 
>= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2
CVE IDs: 
CVE-2026-108514
Description: 

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

Solution: 

Install the latest version:

Drupal 11

  • If you use Drupal 11.4.x, update to Drupal 11.4.10.
  • If you use Drupal 11.3.x, update to Drupal 11.3.19.
  • Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

  • If you use Drupal 10.6.x, update to Drupal 10.6.19.
  • Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Reported By: 
Fixed By: 
Coordinated By: 
打开官方原文 站点原文页 可信分区 本信源更多 今日简报 分享图 RSS 稍后再看列表

相关短闻（同信源优先）