CVE-2026-108515

Name of the Vulnerable Software and Affected Versions Drupal core versions 8.9.0 through 10.6.19 Drupal core versions 11.0.0 through 11.3.19 Drupal core versions 11.4.0 through 11.4.10 Drupal core versions 12.0.0-alpha1 through 12.0.0-beta2

Description An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.