GHSA-pw6f-3999-xp7g

ghsaUSosv

Drupal core allows Cross-Site Scripting (XSS)

view advisory published 2026-05-20Licence: CC-BY-4.0

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-6367US	—	0.20% (10th)	—	2026-05-19
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drup…

references

External citations — patches, advisories, analysis.

https://github.com/drupal/corePACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2026-6367ADVISORY
https://www.drupal.org/sa-core-2026-003WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan