CVE-2026-108514

Name of the Vulnerable Software and Affected Versions Drupal core versions 10.3.0 through 10.6.19 Drupal core versions 11.0.0 through 11.3.19 Drupal core versions 11.4.0 through 11.4.10 Drupal core versions 12.0.0-alpha1 through 12.0.0-beta2

Description An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the administer menu permission.

Recommendations Update Drupal core versions 10.3.0 through 10.6.19 to a version newer than 10.6.19. Update Drupal core versions 11.0.0 through 11.3.19 to a version newer than 11.3.19. Update Drupal core versions 11.4.0 through 11.4.10 to a version newer than 11.4.10. Update Drupal core versions 12.0.0-alpha1 through 12.0.0-beta2 to a version newer than 12.0.0-beta2.