CVE-2026-81167: Drupal Address Suggestion XSS Vulnerability

CVE-2026-81167 Overview

CVE-2026-81167 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Address Suggestion contributed module. The flaw stems from improper neutralization of user input during web page generation, classified under [CWE-79]. It affects Address Suggestion versions 0.0.0 through 1.0.25. Exploitation requires high privileges and user interaction, but the scope changes to impact resources beyond the vulnerable component. Successful exploitation results in limited confidentiality and integrity impact on Drupal sites running the affected module.

Critical Impact
An authenticated attacker with elevated privileges can inject malicious script content that executes in the browsers of other users interacting with the Address Suggestion module, enabling session data theft and unauthorized actions within the Drupal application.

Affected Products

Drupal Address Suggestion module versions 0.0.0 to 1.0.25
Drupal sites with the Address Suggestion contributed module enabled
Any Drupal deployment permitting privileged users to submit address content processed by this module

Discovery Timeline

2026-09-02 - CVE-2026-81167 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81167

Vulnerability Analysis

The Address Suggestion module fails to sanitize user-supplied input before rendering it in generated web pages. When a privileged user submits crafted address data containing HTML or JavaScript payloads, the module stores and later reflects the content without appropriate output encoding. Browsers of visitors viewing affected pages then execute the injected script in the context of the Drupal site.

The vulnerability requires user interaction, meaning a victim must load or interact with a page rendering the tainted data. Because the scope is changed, the injected script can act on resources outside the immediate module context, including other Drupal components accessible in the user's session. Confidentiality and integrity impact are limited to what the executing user's session permits.

Root Cause

The root cause is missing or insufficient output encoding when the Address Suggestion module renders address-related fields into HTML responses. Drupal provides sanitization APIs such as Twig auto-escaping and the Html::escape() helper, but the affected code paths bypass or misuse these protections, allowing raw markup to reach the DOM.

Attack Vector

An authenticated attacker holding a role permitted to submit or edit address content injects a payload containing script tags or event handlers. The stored payload is served to any user who subsequently loads the affected page. The script executes with the victim's session privileges, enabling cookie exfiltration, CSRF-style actions, or DOM manipulation within the Drupal interface.

Refer to the Drupal Security Advisory for module-specific technical details.

Detection Methods for CVE-2026-81167

Indicators of Compromise

Address Suggestion module records containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs stored in module fields
Unexpected outbound requests from user browsers to attacker-controlled domains originating from Drupal pages
Drupal watchdog or web server logs showing form submissions with encoded script payloads targeting Address Suggestion endpoints

Detection Strategies

Review database rows for the Address Suggestion module and search stored values for HTML control characters and script keywords
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations triggered by injected payloads
Correlate Drupal user role changes with subsequent submissions to address-related fields to identify suspicious editorial activity

Monitoring Recommendations

Enable Drupal's dblog or syslog module and forward events to a centralized log platform for query and alerting
Monitor privileged account activity, including content creation and edit events touching Address Suggestion fields
Alert on anomalous JavaScript execution patterns in browser telemetry from users accessing Drupal admin or content pages

How to Mitigate CVE-2026-81167

Immediate Actions Required

Upgrade the Drupal Address Suggestion module to a version later than 1.0.25 once the maintainer publishes a fixed release
Audit user roles and revoke content submission permissions from accounts that do not require them
Inspect existing Address Suggestion records for injected script content and remove or sanitize any suspicious entries

Patch Information

Refer to the Drupal Security Advisory for the fixed module version and upgrade instructions. Apply the update through Drupal's standard module management workflow using Composer or the administrative interface.

Workarounds

Temporarily disable the Address Suggestion module until the patched version is deployed
Restrict access to content types and forms that use the Address Suggestion module to trusted administrators only
Deploy a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins

bash

# Update the Address Suggestion module via Composer
composer update drupal/address_suggestion --with-dependencies
drush updatedb
drush cache:rebuild