CVE-2026-6367
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Published Apr 15, 2026 · updated Jul 24, 2026 · drupal drupal
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 15, 2026 · Drupal Security
Detected
Project: Drupal core Project machine name: drupal <div cl
Jul 24, 2026 · NIST NVD
Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.
Affected
- cpe drupal/drupalversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-6367
Official CVE identifier
cve.org - Drupal SecurityVendor advisoryCVE-2026-6367
Project: Drupal core Project machine name: drupal <div cl
drupal.org - NIST NVDVulnerability recordCVE-2026-6367
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.
nvd.nist.gov