This vulnerability in Drupal Canvas involves improper input sanitization during web page generation, leading to Cross-Site Scripting (CWE-79). Affected versions include =0.0.0, =1.5.0, =1.6.0, and =1.7.0. The issue allows attackers to inject malicious scripts that could execute in the context of users' browsers. There is no CVSS score or vendor advisory indicating a patch or mitigation. The vulnerability is published and reserved under CVE-2026-58588 but lacks further technical or remediation details.

Successful exploitation could allow attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or other malicious actions within the affected web application. However, no known exploits are reported in the wild, and the actual impact depends on the deployment and usage of the affected Drupal Canvas versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying manual input sanitization controls or disabling affected functionality if feasible. Monitor official Drupal channels for updates regarding patches or mitigations.