Project:
Project machine name:
drupalDate:
2026-October-14
Security risk:
Vulnerability:
Cross-site scripting
Affected versions:
>= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2
CVE IDs:
CVE-2026-108514
Description:
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
Solution:
Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.10.
- If you use Drupal 11.3.x, update to Drupal 11.3.19.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.19.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Reported By:
Fixed By:
- Benji Fisher (benjifisher) of the Drupal Security Team
- Jürgen Haas (jurgenhaas)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mingsong (mingsong), provisional member of the Drupal Security
- Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Pablo López (plopesc)
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
Coordinated By:
- cilefen (cilefen) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Domain Tag
drupal
Source Name
Drupal.org Planet
Source URL