CVE-2026-108515
The Drupal core Link module provides a field type that can be used for internal and external URLs.
Published Oct 14, 2026 · updated Oct 14, 2026
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Oct 14, 2026 · OSV.dev
Fix available
drupal/core fixed in 10.6.19
Oct 14, 2026 · OSV.dev
Fix available
drupal/core fixed in 10.6.19
Oct 14, 2026 · OSV.dev
Updated
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Affected
- Packagist drupal/core8.9.0 → 10.6.19