This vulnerability in Drupal Canvas arises from improper sanitization of user input during the generation of web pages, leading to Cross-Site Scripting (CWE-79). Affected versions include 0.0.0 through 1.4.2, 1.5.0 through 1.5.2, 1.6.0 through 1.6.1, and 1.7.0 through 1.7.1. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and results in partial confidentiality and integrity impact without affecting availability. The vendor has not provided an official fix or remediation level, and no patch links are available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session. This may lead to partial disclosure of confidential information and modification of data accessible to the user. There is no impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds from the vendor or restrict access to affected versions where feasible. Monitor official Drupal channels for updates.