CVE-2026-107308

Name of the Vulnerable Software and Affected Versions Drupal Country versions 0.0.0 through 2.1.3 Drupal Country versions 2.2.0 through 2.2.1

Description Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. The issue occurs because the autocomplete widget does not sufficiently escape user input. This cannot occur in a default installation and requires the presence of additional modules or custom code.

Recommendations Update Drupal Country versions 0.0.0 through 2.1.3 to a fixed version. Update Drupal Country versions 2.2.0 through 2.2.1 to a fixed version.