{"id":"DRUPAL-CORE-2026-011","aliases":["CVE-2026-15917"],"title":"DRUPAL-CORE-2026-011","description":"Drupal core 11.2 and above integrate the HTMX JavaScript library.\n\nDrupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.\n\nThe vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.","severity":"unknown","score":null,"published":"2026-07-15T19:51:57.000Z","modified":"2026-07-15T20:56:45.436Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"drupal/core","ranges":[{"events":[{"introduced":"11.3.0"},{"fixed":"11.3.14"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=11.3.0 <11.3.14"}},{"events":[{"introduced":"11.4.0"},{"fixed":"11.4.4"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=11.4.0 <11.4.4"}},{"events":[{"introduced":"11.2.0"},{"fixed":"11.3.0"}],"type":"ECOSYSTEM","database_specific":{"constraint":"11.2.*"}}],"versions":["11.2.0","11.2.1","11.2.10","11.2.11","11.2.12","11.2.13","11.2.14","11.2.2","11.2.3","11.2.4","11.2.5","11.2.6","11.2.7","11.2.8","11.2.9","11.3.0","11.3.0-alpha1","11.3.0-beta1","11.3.0-rc1","11.3.0-rc2","11.3.1","11.3.10","11.3.11","11.3.12","11.3.13","11.3.2","11.3.3","11.3.4","11.3.5","11.3.6","11.3.7","11.3.8","11.3.9","11.4.0","11.4.1","11.4.2","11.4.3"],"fixed":["11.3.14","11.4.4","11.3.0"]}],"references":["https://www.drupal.org/sa-core-2026-011"],"sources":[{"name":"OSV","id":"DRUPAL-CORE-2026-011","modified":"2026-07-15T20:56:45.436756Z","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2026-011"}],"assessments":[]}