CVE-2026-6367 is a CWE-79 Cross-Site Scripting vulnerability in Drupal core affecting versions from 11.3.0 up to but not including 11.3.7. It arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality and integrity impacts. There is no vendor advisory or patch information currently available to confirm remediation status.

Successful exploitation could allow an attacker to execute scripts in the context of the affected Drupal site, potentially leading to limited disclosure of information and modification of data. There is no impact on system availability. The vulnerability requires user interaction and does not require privileges, increasing the risk surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying any recommended temporary mitigations from Drupal or limiting exposure of affected versions. Avoid relying on generic mitigations unless specifically advised by the vendor.