{"id":"DRUPAL-CONTRIB-2026-094","aliases":["CVE-2026-18986"],"title":"DRUPAL-CONTRIB-2026-094","description":"The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget.\n\nThe module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability.\n\nThe vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser.","severity":"unknown","score":null,"published":"2026-08-05T17:59:29.000Z","modified":"2026-09-10T03:45:39.040Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/entity_browser","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.16.0"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<2.16.0"}}],"versions":[],"fixed":["2.16.0"]}],"references":["https://www.drupal.org/sa-contrib-2026-094"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2026-094","modified":"2026-09-10T03:45:39.040314551Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-094"}],"assessments":[]}