This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in Drupal core, leading to Cross-Site Scripting (XSS). It affects a broad range of Drupal core versions, specifically from initial releases through 10.5.12, certain 10.6.x versions, and multiple 11.x versions up to 11.3.12. The vulnerability enables injection of malicious scripts that could be executed in the context of users' browsers. No CVSS score or official remediation level is provided, and no patch links are available. The vendor has not published an official fix or mitigation guidance yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting affected Drupal sites. This may lead to session hijacking, defacement, or other client-side attacks. However, there are no known exploits in the wild currently, and the exact impact depends on the context of the vulnerable Drupal installation and its usage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Drupal's official security advisories for updates. Until a patch is available, consider applying temporary mitigations such as input validation or output encoding where possible, but follow vendor guidance once available.