Threats tagged 'drupal-contrib-2026-335'

The Layout Builder iframe modal module for Drupal renders forms inside an iframe within a modal dialog using the admin theme. It includes a custom Ajax command to open the iframe dialog that does not sanitize dialog options as strictly as Drupal core does, leading to a potential cross-site scripting (XSS) vulnerability. Exploitation requires the attacker to control the Ajax response or inject markup with specific attributes. A fix is available in version 1.3.9.