Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Дата публикации: 15-07-2026 19:51:57

Project: Drupal coreDate: 2026-July-15Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.*CVE IDs: CVE-2026-15917Description: Drupal core 11.2 and above integrate the HTMX JavaScript library.
Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.Solution: Install the latest version:
Drupal 11
If you use Drupal 11.4.x, update to Drupal 11.4.4.
If you use Drupal 11.3.x, update to Drupal 11.3.14.
Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
Drupal 10 core is not affected. However, certain contributed modules may be affected, so a Drupal 10.6 fix is included as hardening.
Drupal 8 and Drupal 9 have both reached end-of-life.Reported By: 
Pierre Rudloff (prudloff) of the Drupal Security Team
Fixed By: 
Shawn Duncan (fathershawn)
Pierre Rudloff (prudloff) of the Drupal Security Team
Coordinated By: 
catch (catch) of the Drupal Security Team
Lee Rowlands (larowlan) of the Drupal Security Team
Dave Long (longwave) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Схожие новости

#	Наименование новости	Тональность	Информативность	Дата публикации
1	Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012	0	5	15-07-2026
2	Security advisories: Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010	0	5	15-07-2026
3	Security public service announcements: Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20	0	17.87	21-10-2026
4	Webpro Company blog: Drupal core July security updates: what site owners should check now	0	7	16-07-2026
5	Tag1 Insights: PHP2Shell: What PHP Site Owners Should Do Today	0	16.85	21-10-2026
6	Drupal.org blog: Migrating issues from security.drupal.org to git.drupalcode.org	5	7	17-07-2026
7	PreviousNext: How we secured our clients’ Drupal sites with critical PHP security updates	0	13.12	22-10-2026
8	Drupal Association blog: After the PHP security release: auditing your Drupal sites	0	13.6	22-10-2026
9	Dynamosys Insights: PHP2Shell: Updating Drupal Won’t Fix These Critical PHP Flaws	0	7.88	22-10-2026
10	August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw	0	20.98	14-08-2026

Классификация: Пресс-релизы. Схожих патентов: 0. Схожих новостей: 10. Тональность: 0. Информативность: 7. Источник: www.drupal.org.