{"id":"DRUPAL-CONTRIB-2026-211","aliases":["CVE-2026-107308"],"title":"DRUPAL-CONTRIB-2026-211","description":"The module Country provides a dedicated field type for Drupal core's official country list.\n\nThe module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability.\n\nThis vulnerability is mitigated by the fact that it can not occur out of the box with the Country module, additional module(s) or custom code is required.","severity":"unknown","score":null,"published":"2026-10-07T16:36:17.000Z","modified":"2026-10-07T20:15:06.632Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/country","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.1.3"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<2.1.3"}},{"events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=2.2.0 <2.2.1"}}],"versions":[],"fixed":["2.1.3","2.2.1"]}],"references":["https://www.drupal.org/sa-contrib-2026-211"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2026-211","modified":"2026-10-07T20:15:06.632630385Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-211"}],"assessments":[]}