Block attributes: This module allows you to define custom attributes for a block. (CVE-2026-114534)

CVE-2026-114534 describes a vulnerability in the Drupal Block Attributes module (versions prior to 2.1.0) where custom block attributes are not properly sanitized, enabling cross-site scripting (XSS). The vulnerability is mitigated by the requirement that an attacker must have the 'administer blocks' permission to exploit it. This limits the risk to users with elevated privileges. A fix has been made available in version 2.1.0.

Successful exploitation could allow an attacker with 'administer blocks' permission to inject malicious scripts via block attributes, potentially leading to XSS attacks. However, since the attacker must already have administrative permissions related to blocks, the impact is limited to privileged users and does not affect anonymous or lower-privileged users.

Upgrade the Block Attributes module to version 2.1.0 or later where the vulnerability is patched. Since a patch is available, applying the official fix is the recommended remediation.