CVE-2026-108514
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
Published Oct 14, 2026 · updated Oct 14, 2026
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the permission.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the permission.
Oct 14, 2026 · OSV.dev
Fix available
drupal/core fixed in 10.6.19
Oct 14, 2026 · OSV.dev
Fix available
drupal/core fixed in 10.6.19
Oct 14, 2026 · OSV.dev
Updated
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the permission.
Affected
- Packagist drupal/core10.3.0 → 10.6.19