This vulnerability (CVE-2026-58591) in the Drupal Colorbox module is classified as CWE-79, indicating improper neutralization of input leading to Cross-Site Scripting (XSS). It affects all versions from initial release (0.0.0) through 2.2.0. The vulnerability allows an attacker with low privileges and requiring user interaction to execute scripts in the context of the affected web application, potentially leading to partial confidentiality and integrity impacts. The vulnerability has a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No official fix or patch is currently documented, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected Drupal Colorbox module, potentially leading to limited confidentiality and integrity compromise. There is no impact on availability. The attacker requires low privileges and user interaction to exploit this vulnerability. The scope is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor Drupal security advisories for updates regarding a patch or official mitigation.