CVE-2026-55805

1 advisory.

Packagist/drupal/core CVE-2026-55805: unknown, EPSS 0.23%

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.

Action: Upgrade drupal/core to 10.6.13 or later.

composer require drupal/core:10.6.13

composer require drupal/core:11.3.14

composer require drupal/core:11.4.4

composer require drupal/core:11.1.0

composer require drupal/core:11.2.0

composer require drupal/core:11.3.0

Affected

introduced	fixed	last affected
0	10.6.13	-
11.3.0	11.3.14	-
11.4.0	11.4.4	-
11.0.0	11.1.0	-
11.1.0	11.2.0	-
11.2.0	11.3.0	-

Fixed versions

10.6.13

11.3.14

11.4.4

11.1.0

11.2.0

11.3.0

Sources

osv: DRUPAL-CORE-2026-012
https://www.drupal.org/sa-core-2026-012

CVE-2026-55805 · published 2026-07-15T19:52:26Z · modified 2026-07-15T20:56:45.672035Z · JSON