CVE-2026-81201: Drupal Monster Menus XSS Vulnerability

CVE-2026-81201 Overview

CVE-2026-81201 is a stored cross-site scripting (XSS) vulnerability in the Drupal Monster Menus contributed module. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The vulnerability affects Monster Menus versions from 0.0.0 through 9.5.3. Exploitation requires user interaction and changes the security scope, enabling session compromise, content defacement, and phishing against authenticated Drupal users.

Critical Impact
Unauthenticated attackers can store malicious scripts that execute against site visitors and administrators, potentially hijacking privileged sessions.

Affected Products

Drupal Monster Menus module versions 0.0.0 through 9.5.3
Drupal sites with the Monster Menus contributed module enabled
Any site permitting untrusted user input into Monster Menus fields

Discovery Timeline

2026-09-02 - CVE-2026-81201 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81201

Vulnerability Analysis

Monster Menus fails to properly sanitize input before rendering it into HTML output. The module accepts user-controlled data through menu-related fields and stores it in the Drupal database. When another user requests a page containing that data, the application returns unsanitized content in the response body. The browser then parses attacker-supplied markup as executable script.

The stored nature of this XSS increases its reach compared to reflected variants. A single injection persists across sessions and impacts every viewer of the affected content. Because the vulnerability scope changes across a trust boundary, script execution in an administrator's session can trigger actions against the Drupal backend.

Root Cause

The root cause is missing or insufficient output encoding in code paths that render Monster Menus content. Drupal's rendering pipeline expects contributed modules to mark untrusted strings for escaping or filtering. Monster Menus emits attacker-controlled values into HTML contexts without applying the required sanitization, violating the [CWE-79] output-encoding contract.

Attack Vector

An attacker with the ability to submit content through Monster Menus stores a payload containing HTML or JavaScript. When a victim loads a page that renders that payload, their browser executes the script in the origin of the Drupal site. Typical outcomes include session cookie theft, forced administrative actions via CSRF, credential harvesting through injected forms, and delivery of drive-by browser exploits. No authentication is required to trigger execution against the victim, though user interaction (loading the page) is necessary.

See the Drupal Security Advisory for context on the affected code paths.

Detection Methods for CVE-2026-81201

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (onerror, onload) stored in Monster Menus records
Outbound requests from user browsers to unfamiliar domains after loading menu pages
Anomalous administrative actions performed by legitimate admin accounts shortly after page views

Detection Strategies

Query the Drupal database for Monster Menus fields containing HTML tags or JavaScript URI schemes such as javascript:
Review web server access logs for POST requests to Monster Menus endpoints from untrusted sources
Inspect rendered HTML for injected script tags using automated crawlers or DOM-diffing tools

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script-src violations on Drupal pages
Monitor session activity for privilege escalation patterns following content edits
Correlate content-change events with subsequent authenticated actions using a centralized SIEM

How to Mitigate CVE-2026-81201

Immediate Actions Required

Upgrade the Monster Menus module to a version later than 9.5.3 per the Drupal Security Advisory
Audit existing Monster Menus content for stored HTML or JavaScript payloads and remove malicious entries
Rotate administrator credentials and invalidate active sessions if injection is confirmed

Patch Information

Refer to the Drupal Security Advisory sa-contrib-2026-116 for the fixed release and upgrade instructions. Apply the update through Drupal's standard module management workflow and clear caches after deployment.

Workarounds

Restrict permissions to create or edit Monster Menus content to trusted roles only
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources
Place a web application firewall in front of Drupal to filter HTML tags in Monster Menus form submissions

bash

# Drush upgrade example for Monster Menus
drush pm:update monster_menus
drush cache:rebuild
drush watchdog:show --type=security