This vulnerability (CVE-2026-8493) in the Drupal Colorbox Inline module is classified as CWE-79, indicating improper neutralization of input during web page generation leading to Cross-Site Scripting (XSS). It affects all versions prior to 2.1.1. The CVSS 3.1 base score is 5.4 (medium), with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality and integrity with no availability impact. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected Drupal site, potentially leading to partial disclosure of confidential information and modification of data integrity. There is no impact on system availability. The attack requires user interaction and low privileges, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting user input that can be rendered by the Colorbox Inline module and applying web application firewall (WAF) rules to detect and block XSS payloads related to this module. Monitor official Drupal channels for updates and patches.