Project:
Project machine name:
drupalDate:
2026-October-14
Vulnerability:
Cross-site scripting
Affected versions:
>= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2
CVE IDs:
CVE-2026-108515
Description:
The Drupal core Link module provides a field type that can be used for internal and external URLs.
The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Solution:
Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.10.
- If you use Drupal 11.3.x, update to Drupal 11.3.19.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.19.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Reported By:
Fixed By:
- Benji Fisher (benjifisher) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- David Cameron (dcam)
- Shawn Duncan (fathershawn)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Ra Mänd (ram4nd)
- Jess (xjm) of the Drupal Security Team
Domain Tag
drupal
Source Name
Drupal.org Planet
Source URL