CVE-2026-110738
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators.
Published Oct 14, 2026 · updated Oct 14, 2026
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes or the permission.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes o
Oct 14, 2026 · OSV.dev
Fix available
drupal/gin fixed in 4.1.4
Oct 14, 2026 · OSV.dev
Fix available
drupal/gin fixed in 4.1.4
Oct 14, 2026 · OSV.dev
Updated
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes o
Affected
- Packagist:https://packages.drupal.org/8 drupal/gin0 → 4.1.4