DRUPAL-CORE-2026-012

En bref

Publiée: 2026-07-15 19:52 UTC
Mise à jour: 2026-07-15 20:56 UTC
CVE: CVE-2026-55805

Description

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.

Paquets affectés

Paquet	Versions
Packagist · drupal/core	introduced 0, fixed 10.6.13 ; introduced 11.3.0, fixed 11.3.14 ; introduced 11.4.0, fixed 11.4.4 ; introduced 11.0.0, fixed 11.1.0 ; introduced 11.1.0, fixed 11.2.0 ; introduced 11.2.0, fixed 11.3.0

Références

https://www.drupal.org/sa-core-2026-012 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence