CVE-2026-15917

Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4

Description Drupal core contains a cross-site scripting (XSS) issue due to improper neutralization of input during web page generation. The XSS filter does not sufficiently sanitize certain attributes from the integrated HTMX JavaScript library, allowing an attacker to execute malicious scripts if they can insert HTML with specific attributes.

Recommendations Update Drupal core to a version later than 11.3.14. Update Drupal core to a version later than 11.4.4.