Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting… (CVE-2026-15917)

CVE-2026-15917 is a Cross-Site Scripting (XSS) vulnerability in Drupal core caused by improper neutralization of input during web page generation. This flaw affects Drupal core versions from 0.0.0 through 11.2.*, 11.3.0 through 11.3.14, and 11.4.0 through 11.4.4. The vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users. The CVSS 3.1 base score is 4.7, indicating medium severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity. No vendor advisory or patch information is provided in the input data.

The vulnerability allows attackers to perform Cross-Site Scripting attacks, potentially leading to partial disclosure of confidential information and modification of data in affected Drupal web applications. The attack requires user interaction and has high attack complexity, limiting the ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Drupal security advisories for updates and apply any official patches once available. Until then, consider applying temporary mitigations recommended by Drupal or limiting exposure of affected versions.