CVE-2026-55808: Drupal Core XSS Vulnerability

CVE-2026-55808 Overview

CVE-2026-55808 is a Cross-Site Scripting (XSS) vulnerability in Drupal core caused by improper neutralization of input during web page generation [CWE-79]. The flaw allows an authenticated attacker to inject scripts that execute in a victim's browser session after user interaction. Affected releases include Drupal core 0.0.0 through 10.5.12, 10.6.0 through 10.6.11, 11.2.0 through 11.2.14, 11.3.0 through 11.3.12, and the 11.0.x and 11.1.x branches. Drupal published fixes in security advisory SA-CORE-2026-009.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session data theft, UI defacement, and cross-tenant actions within the Drupal application.

Affected Products

Drupal core 0.0.0 through 10.5.12 and 10.6.0 through 10.6.11
Drupal core 11.0.x, 11.1.x, and 11.2.0 through 11.2.14
Drupal core 11.3.0 through 11.3.12

Discovery Timeline

2026-07-10 - CVE-2026-55808 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55808

Vulnerability Analysis

The vulnerability resides in Drupal core's output rendering pipeline where user-supplied input is emitted into generated HTML without adequate escaping or sanitization. An authenticated user with permission to submit content into an affected code path can embed script payloads that execute when another user renders the response. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component, including administrative sessions rendered in the same browser context. Confidentiality and integrity impacts are limited to the affected user's browser session, and availability is not affected.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. A rendering path in Drupal core writes attacker-controllable values into HTML without applying context-appropriate escaping such as Html::escape() or Twig auto-escaping. Because the affected fields flow through code that treats content as safe markup, script tokens survive to the browser and are parsed as executable JavaScript.

Attack Vector

An attacker requires low-privilege authenticated access and must lure a victim to view the crafted content. The attacker submits a payload containing HTML or JavaScript into a field or parameter reached by the vulnerable render path. When a privileged user, such as an editor or administrator, views the page containing the payload, the browser executes the script under the site's origin. Refer to the Drupal Security Advisory SA-CORE-2026-009 for technical specifics on the affected code path.

Detection Methods for CVE-2026-55808

Indicators of Compromise

Drupal content, comment, or field values containing <script>, javascript:, onerror=, onload=, or encoded variants such as <script>.
Web server access logs showing POST or PATCH requests to content endpoints with payloads containing HTML control characters from low-privileged accounts.
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after loading Drupal admin pages.
New or modified administrator accounts, API tokens, or role assignments created via authenticated Drupal actions immediately after content views.

Detection Strategies

Inspect stored content in node, comment, field_*, and taxonomy tables for HTML event handlers or <script> tags that were not intended by editors.
Enable and review Drupal dblog and syslog entries for authentication events, permission changes, and content edits correlated with suspicious viewer sessions.
Deploy Content Security Policy (CSP) reporting to capture inline script violations that indicate injection attempts against Drupal-rendered pages.

Monitoring Recommendations

Alert on administrator account activity that occurs in the same session as viewing user-generated content, especially privilege or module configuration changes.
Monitor WAF logs for XSS signatures targeting Drupal endpoints such as /node/add, /comment/reply, and REST or JSON:API routes.
Track outbound HTTP requests from browsers of privileged Drupal users to detect exfiltration triggered by injected scripts.

How to Mitigate CVE-2026-55808

Immediate Actions Required

Upgrade Drupal core to a fixed release: 10.5.13 or later on the 10.5 branch, 10.6.12 or later on the 10.6 branch, 11.2.15 or later on the 11.2 branch, and 11.3.13 or later on the 11.3 branch, per SA-CORE-2026-009.
Rotate administrator session cookies and API tokens after patching, since existing sessions may have been targeted.
Audit recent content submissions from low-privileged accounts for embedded HTML or script payloads and remove malicious entries.

Patch Information

Drupal has released fixed versions as described in the Drupal Security Advisory SA-CORE-2026-009. Sites running 11.0.x or 11.1.x, which are no longer supported, should upgrade to a supported minor release. Apply the update using composer update drupal/core --with-dependencies followed by drush updatedb and cache rebuild.

Workarounds

Restrict content creation and commenting permissions to trusted roles until the upgrade is completed.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of injected payloads.
Place the Drupal site behind a WAF with XSS rulesets enabled and block requests containing script tokens on content submission endpoints.

bash

# Configuration example
# Upgrade Drupal core to a patched release
composer update drupal/core drupal/core-recommended drupal/core-composer-scaffold --with-all-dependencies
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild

# Verify installed version matches a fixed release
vendor/bin/drush status --field=drupal-version