CVE-2026-15917: Drupal Core XSS Vulnerability

CVE-2026-15917 Overview

CVE-2026-15917 is a Cross-Site Scripting (XSS) vulnerability in Drupal core. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An attacker can inject malicious script content that executes in a victim's browser when the affected page is rendered.

Exploitation requires user interaction and high attack complexity, but no authentication is needed. Successful attacks affect confidentiality and integrity across a changed security scope, enabling session context leakage or unauthorized actions on behalf of the victim.

Critical Impact

Attackers can execute arbitrary JavaScript in the context of Drupal site visitors, potentially hijacking sessions, defacing content, or redirecting users to malicious destinations.

Affected Products

• Drupal core versions 11.3.0 through 11.3.14
• Drupal core versions 11.4.0 through 11.4.4
• Drupal core versions 0.0.0 through 11.2.*

Discovery Timeline

• 2026-08-25 - CVE-2026-15917 published to the National Vulnerability Database
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-15917

Vulnerability Analysis

The vulnerability resides in Drupal core's handling of input rendered into HTML output. Drupal fails to properly neutralize special characters within user-controlled input before the data is written to a generated web page. This omission permits an attacker to embed executable script fragments into content that reaches other users' browsers.

Because the flaw operates across a changed security scope, injected script can influence resources beyond the vulnerable component. That behavior amplifies the impact on integrity and confidentiality even though direct availability effects are absent. Exploitation requires a victim to interact with attacker-influenced content, such as viewing a crafted page or following a specific link.

Root Cause

The defect is a missing or incomplete output encoding step for input that flows into an HTML rendering context. When Drupal generates the response page, attacker-controlled data is treated as markup rather than inert text. Browsers subsequently parse and execute the payload as script.

Attack Vector

An unauthenticated remote attacker submits crafted content that Drupal later renders to another user. When the targeted user loads the page, the browser executes the injected JavaScript in the site's origin. The attacker can then read cookies accessible to scripts, issue authenticated requests, or manipulate the rendered DOM.

No verified proof-of-concept is publicly available. Refer to the Drupal Security Advisory SA-CORE-2026-011 for vendor-provided technical detail.

Detection Methods for CVE-2026-15917

Indicators of Compromise

• Unexpected <script> tags, event handler attributes (onerror, onload), or javascript: URIs stored in Drupal content entities, comments, or field values.
• Web server access logs showing requests containing encoded script payloads targeting content submission endpoints.
• Outbound browser requests from authenticated Drupal sessions to unfamiliar third-party domains shortly after loading a specific page.

Detection Strategies

• Audit stored content in Drupal databases for HTML sequences that should have been neutralized by the text format filter pipeline.
• Deploy a web application firewall rule set that identifies XSS payload patterns in POST bodies targeting Drupal endpoints such as /node/add and /comment/reply.
• Correlate anomalous JavaScript execution reported by Content Security Policy (CSP) violation endpoints with recent content edits.

Monitoring Recommendations

• Enable CSP reporting on Drupal sites and forward violation reports to a central log store for review.
• Monitor Drupal watchdog logs and reverse proxy logs for spikes in requests to content editing paths from unauthenticated sources.
• Track user session anomalies such as unexpected privilege changes or content modifications following visits to attacker-referenced URLs.

How to Mitigate CVE-2026-15917

Immediate Actions Required

• Upgrade Drupal core to a fixed release as identified in the Drupal Security Advisory SA-CORE-2026-011.
• Inventory all Drupal sites in the environment and confirm running versions against the affected ranges.
• Rotate administrative session credentials on any site that cannot be immediately patched.

Patch Information

Drupal has released fixed versions addressing the affected 11.3.x, 11.4.x, and pre-11.3 branches. Apply the update guidance published in Drupal Security Advisory SA-CORE-2026-011. Test the upgrade in a staging environment before promoting to production and clear all caches after deployment.

Workarounds

• Restrict content submission privileges to trusted authenticated users until patches are applied.
• Enforce a strict Content Security Policy that disallows inline scripts and limits allowed script sources.
• Enable a web application firewall with XSS filtering in front of the Drupal site to block common payload patterns.

# Example Content-Security-Policy header for Drupal
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"