SA-CORE-2026-012: XSS
The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.4.4Fixed in 11.3.14Fixed in 10.6.13
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2026-012?
The severity of SA-CORE-2026-012 is classified as critical with a score of 9.
What type of vulnerability is identified in SA-CORE-2026-012?
SA-CORE-2026-012 identifies a cross-site scripting (XSS) vulnerability.
How do I fix SA-CORE-2026-012?
To fix SA-CORE-2026-012, ensure that you sanitize block labels properly in the Layout Builder module.
What software is affected by SA-CORE-2026-012?
SA-CORE-2026-012 affects the Drupal content management system.
What conditions exacerbate the risk of SA-CORE-2026-012?
The risk of SA-CORE-2026-012 is exacerbated when both the attacker and the targeted user are using the Layout Builder editing interface.