Sector: A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. (CVE-2026-107260)

The Sector Drupal distribution includes a module that does not properly sanitize media names, leading to a potential XSS vulnerability (CVE-2026-107260). This flaw allows attackers with media creation or editing privileges to inject malicious scripts via media names. The vulnerability affects versions before 10.3.3 and versions 10.4.0 through 10.4.1. A fix has been released to remediate the issue.

An attacker with the ability to create or edit media entities can exploit this vulnerability to execute cross-site scripting attacks. This could lead to unauthorized script execution in the context of users viewing the affected media names, potentially compromising user sessions or site integrity. However, the requirement for specific permissions limits the scope of exploitation.

A patch is available for this vulnerability. Users should upgrade to versions 10.3.3 or later, excluding versions 10.4.0 through 10.4.1, which remain vulnerable. Applying the official fix will remediate the issue. Since exploitation requires specific user roles, restricting permissions to trusted users can also reduce risk.