CVE-2026-15917: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal Drupal core

This vulnerability (CVE-2026-15917) in Drupal core is classified as CWE-79, indicating improper neutralization of input leading to Cross-Site Scripting (XSS). It affects Drupal core versions from 0.0.0 through 11.2.*, 11.3.0 through 11.3.14, and 11.4.0 through 11.4.4. The CVSS 3.1 base score is 4.7, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity. No vendor advisory or patch information is currently available, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected Drupal web application, potentially leading to partial disclosure of confidential information and modification of data. However, exploitation requires user interaction and has high attack complexity, limiting the ease of exploitation. There is no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Drupal security advisories for updates. No specific temporary mitigations are provided in the available data.