DRUPAL-CORE-2026-016
The advisory, in context
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 10.3.0 before 10.6.19
Fixed in 10.6.19
From 11.0.0 before 11.3.19
Fixed in 11.3.19
From 11.4.0 before 11.4.10
Fixed in 11.4.10
From 12.0.0-alpha1 before 12.0.0-beta2
Fixed in 12.0.0-beta2
144 explicitly affected versions
10.3.0, 10.3.1, 10.3.10, 10.3.11, 10.3.12, 10.3.13, 10.3.14, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.3.7, 10.3.8, 10.3.9, 10.4.0, 10.4.0-beta1, 10.4.0-rc1, 10.4.1, 10.4.10, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6, 10.4.7, 10.4.8, 10.4.9, 10.5.0, 10.5.0-beta1, 10.5.0-rc1, 10.5.1, 10.5.10, 10.5.11, 10.5.12, 10.5.2, 10.5.3, 10.5.4, 10.5.5, 10.5.6, 10.5.7, 10.5.8, 10.5.9, 10.6.0, 10.6.0-beta1, 10.6.0-rc1, 10.6.1, 10.6.10, 10.6.11, 10.6.12, 10.6.13, 10.6.14, 10.6.15, 10.6.16, 10.6.17, 10.6.18, 10.6.2, 10.6.3, 10.6.4, 10.6.5, 10.6.6, 10.6.7, 10.6.8, 10.6.9, 11.0.0, 11.0.1, 11.0.10, 11.0.11, 11.0.12, 11.0.13, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9, 11.1.0, 11.1.0-beta1, 11.1.0-rc1, 11.1.1, 11.1.10, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.1.9, 11.2.0, 11.2.0-alpha1, 11.2.0-beta1, 11.2.0-rc1, 11.2.0-rc2, 11.2.1, 11.2.10, 11.2.11, 11.2.12, 11.2.13, 11.2.14, 11.2.2, 11.2.3, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.2.9, 11.3.0, 11.3.0-alpha1, 11.3.0-beta1, 11.3.0-rc1, 11.3.0-rc2, 11.3.1, 11.3.10, 11.3.11, 11.3.12, 11.3.13, 11.3.14, 11.3.16, 11.3.17, 11.3.18, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6, 11.3.7, 11.3.8, 11.3.9, 11.4.0, 11.4.1, 11.4.2, 11.4.3, 11.4.4, 11.4.5, 11.4.6, 11.4.7, 11.4.8, 11.4.9, 12.0.0-alpha1, 12.0.0-beta1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.6.19"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">= 10.3.0 < 10.6.19"
}
},
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.3.19"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">= 11.0.0 < 11.3.19"
}
},
{
"events": [
{
"introduced": "11.4.0"
},
{
"fixed": "11.4.10"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">= 11.4.0 < 11.4.10"
}
},
{
"events": [
{
"introduced": "12.0.0-alpha1"
},
{
"fixed": "12.0.0-beta2"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">= 12.0.0-alpha1 < 12.0.0-beta2"
}
}
],
"versions": [
"10.3.0",
"10.3.1",
"10.3.10",
"10.3.11",
"10.3.12",
"10.3.13",
"10.3.14",
"10.3.2",
"10.3.3",
"10.3.4",
"10.3.5",
"10.3.6",
"10.3.7",
"10.3.8",
"10.3.9",
"10.4.0",
"10.4.0-beta1",
"10.4.0-rc1",
"10.4.1",
"10.4.10",
"10.4.2",
"10.4.3",
"10.4.4",
"10.4.5",
"10.4.6",
"10.4.7",
"10.4.8",
"10.4.9",
"10.5.0",
"10.5.0-beta1",
"10.5.0-rc1",
"10.5.1",
"10.5.10",
"10.5.11",
"10.5.12",
"10.5.2",
"10.5.3",
"10.5.4",
"10.5.5",
"10.5.6",
"10.5.7",
"10.5.8",
"10.5.9",
"10.6.0",
"10.6.0-beta1",
"10.6.0-rc1",
"10.6.1",
"10.6.10",
"10.6.11",
"10.6.12",
"10.6.13",
"10.6.14",
"10.6.15",
"10.6.16",
"10.6.17",
"10.6.18",
"10.6.2",
"10.6.3",
"10.6.4",
"10.6.5",
"10.6.6",
"10.6.7",
"10.6.8",
"10.6.9",
"11.0.0",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.2",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9",
"11.1.0",
"11.1.0-beta1",
"11.1.0-rc1",
"11.1.1",
"11.1.10",
"11.1.2",
"11.1.3",
"11.1.4",
"11.1.5",
"11.1.6",
"11.1.7",
"11.1.8",
"11.1.9",
"11.2.0",
"11.2.0-alpha1",
"11.2.0-beta1",
"11.2.0-rc1",
"11.2.0-rc2",
"11.2.1",
"11.2.10",
"11.2.11",
"11.2.12",
"11.2.13",
"11.2.14",
"11.2.2",
"11.2.3",
"11.2.4",
"11.2.5",
"11.2.6",
"11.2.7",
"11.2.8",
"11.2.9",
"11.3.0",
"11.3.0-alpha1",
"11.3.0-beta1",
"11.3.0-rc1",
"11.3.0-rc2",
"11.3.1",
"11.3.10",
"11.3.11",
"11.3.12",
"11.3.13",
"11.3.14",
"11.3.16",
"11.3.17",
"11.3.18",
"11.3.2",
"11.3.3",
"11.3.4",
"11.3.5",
"11.3.6",
"11.3.7",
"11.3.8",
"11.3.9",
"11.4.0",
"11.4.1",
"11.4.2",
"11.4.3",
"11.4.4",
"11.4.5",
"11.4.6",
"11.4.7",
"11.4.8",
"11.4.9",
"12.0.0-alpha1",
"12.0.0-beta1"
]
}