Packagist/drupal/core CVE-2026-6365: medium 6.1, EPSS 0.22%

Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability.

Action: Upgrade drupal/core to 10.5.9 or later.

composer require drupal/core:10.5.9

composer require drupal/core:10.6.7

composer require drupal/core:11.2.11

composer require drupal/core:11.3.7

Affected

introduced	fixed	last affected
8.0.0	10.5.9	-
10.6.0	10.6.7	-
11.0.0	11.2.11	-
11.3.0	11.3.7	-

Fixed versions

10.5.9

10.6.7

11.2.11

11.3.7

Sources

osv: DRUPAL-CORE-2026-001
nvd: CVE-2026-6365
https://www.drupal.org/sa-core-2026-001

CVE-2026-6365 · published 2026-04-15T19:24:30Z · modified 2026-09-10T03:45:13.636759663Z · JSON