CVE-2026-6365: Drupal Core XSS Vulnerability

CVE-2026-6365 Overview

CVE-2026-6365 is a Cross-Site Scripting (XSS) vulnerability in Drupal core. The flaw stems from improper neutralization of input during web page generation [CWE-79]. An attacker can inject malicious script content that executes in the context of a victim's browser when the user interacts with a crafted link or page.

The vulnerability affects multiple supported Drupal core branches, including versions in the 8.x, 10.x, and 11.x lines. Drupal has issued a security advisory and patched releases under reference SA-CORE-2026-001.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session theft, content manipulation, and pivoting toward administrative account takeover.

Affected Products

• Drupal core 8.0.0 through versions before 10.5.9
• Drupal core 10.6.0 through versions before 10.6.7
• Drupal core 11.0.0 through versions before 11.2.11, and 11.3.0 through versions before 11.3.7

Discovery Timeline

• 2026-05-19 - CVE-2026-6365 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-6365

Vulnerability Analysis

The vulnerability is a stored or reflected Cross-Site Scripting flaw in Drupal core. Drupal fails to properly neutralize user-supplied input before rendering it as part of a web page. When the unsanitized content is included in HTML output, the browser interprets attacker-controlled markup as executable script.

Exploitation requires user interaction, such as clicking a crafted link or visiting a page containing injected payload. The attack is network-reachable and requires no prior privileges on the target site. Because the scope changes during exploitation, script execution can affect resources beyond the vulnerable component, including authenticated administrative sessions.

Drupal core powers a wide range of public-facing sites, which increases the operational risk of leaving sites unpatched. Attackers commonly chain XSS in content management systems with social engineering to harvest session cookies or perform actions on behalf of editors and administrators.

Root Cause

The root cause is insufficient output encoding or sanitization in a code path that renders user-controlled data to HTML. Specific component details are tracked under the Drupal security advisory SA-CORE-2026-001. The CWE classification is [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is the network. An unauthenticated attacker can craft input or a URL that, when processed by a vulnerable Drupal site and rendered to a victim, triggers JavaScript execution in the victim's browser. The attacker does not need an account on the target site, but a victim must view or interact with the malicious content.

No verified public proof-of-concept code is currently available. See the Drupal Security Advisory for technical details and patch information.

Detection Methods for CVE-2026-6365

Indicators of Compromise

• Web access logs containing requests with HTML or JavaScript fragments such as <script>, onerror=, onload=, or encoded variants in query strings, form fields, or path segments.
• Unexpected outbound requests from authenticated administrator sessions to attacker-controlled domains shortly after viewing user-submitted content.
• New or modified Drupal user accounts with elevated roles created from sessions tied to administrative IP addresses without a corresponding manual change.

Detection Strategies

• Inspect Drupal content and field submissions for HTML event handler attributes and inline script tags in stored data.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts before enforcing it in production.
• Correlate web server logs with browser error telemetry to identify reflected payloads that triggered client-side execution.

Monitoring Recommendations

• Monitor Drupal watchdog and reverse proxy logs for anomalous parameter values containing markup or encoded script content.
• Alert on administrative actions performed immediately after a user views third-party submitted content, such as role assignments or module installs.
• Track the deployed Drupal core version across all sites and flag any host running versions earlier than 10.5.9, 10.6.7, 11.2.11, or 11.3.7.

How to Mitigate CVE-2026-6365

Immediate Actions Required

• Upgrade Drupal core to 10.5.9, 10.6.7, 11.2.11, or 11.3.7 or later, depending on the branch in use.
• Audit recent content submissions, comments, and user profile fields for injected HTML or JavaScript and remove malicious entries.
• Force password resets and invalidate sessions for administrative accounts that may have viewed untrusted content prior to patching.

Patch Information

Drupal has released fixed versions of core addressing CVE-2026-6365. Apply the updates referenced in the Drupal Security Advisory SA-CORE-2026-001. Sites running end-of-life Drupal branches should migrate to a supported release before applying the patch.

Workarounds

• Restrict permissions for untrusted users so they cannot submit content fields that accept HTML formats until the patch is applied.
• Enforce a strict Content Security Policy that blocks inline scripts and disallows untrusted script sources to reduce the impact of a successful injection.
• Place the site behind a web application firewall with rules that block common XSS payload patterns in request parameters.

# Example: upgrade Drupal core using Composer
composer update drupal/core-recommended --with-dependencies
drush updatedb
drush cache:rebuild