CVE-2026-6365 is a medium severity Cross-Site Scripting (XSS) vulnerability in Drupal core caused by improper neutralization of input during web page generation (CWE-79). It affects Drupal core versions from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7. The vulnerability allows remote attackers to execute arbitrary scripts in the context of the affected site, potentially leading to limited confidentiality and integrity impacts. The CVSS vector indicates the attack requires network access, low attack complexity, no privileges, and user interaction, with scope changed. No official patch or remediation level is indicated in the available data, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected Drupal site, potentially leading to limited disclosure of confidential information and modification of data integrity. There is no impact on system availability. The attack requires user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided in the available data, users should monitor Drupal's official security advisories for updates and apply any released fixes promptly. Until a patch is available, consider restricting user input or employing web application firewalls that can detect and block XSS attempts specific to Drupal.