SA-CORE-2026-011: XSS
Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.4.4Fixed in 11.3.14
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2026-011?
The severity of SA-CORE-2026-011 is critical, with a score of 9.
How do I fix SA-CORE-2026-011?
To fix SA-CORE-2026-011, update your Drupal installation to version 11.2 or higher where the issue has been addressed.
What types of attacks does SA-CORE-2026-011 facilitate?
SA-CORE-2026-011 facilitates cross-site scripting (XSS) attacks due to insufficient sanitization of HTMX attributes.
Which versions of Drupal are affected by SA-CORE-2026-011?
SA-CORE-2026-011 affects Drupal core versions 11.2 and above.
What is the main issue with SA-CORE-2026-011?
The main issue with SA-CORE-2026-011 is that Drupal's XSS filter does not adequately sanitize certain HTMX attributes, leading to a potential XSS vulnerability.