CVE-2026-108514
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
Published Oct 14, 2026 · updated Oct 14, 2026 · Drupal Drupal
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the permission.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the permission.
Oct 14, 2026 · OSV.dev
Fix available
drupal/core fixed in 10.6.19
Oct 14, 2026 · OSV.dev
Fix available
drupal/core fixed in 10.6.19
Oct 14, 2026 · OSV.dev
Updated
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the permission.
Affected
- Packagist drupal/core10.3.0 → 10.6.19
Sources
- CVE.orgVulnerability recordCVE-2026-108514
Official CVE identifier
cve.org - Drupal SecurityVendor advisoryCVE-2026-108514
Project: Drupal core Project machine name: drupal <div cl
drupal.org - OSV.devPackage advisoryDRUPAL-CORE-2026-016osv.dev