- Package
- drupal/sector
- Fixed in
- 10.3.3, 10.4.2
- Published
- Wed 21 Oct 2026, 18:43 Lisbon
- Installs on Packagist
- 13K
In plain words
A module specific to Sector does not sufficiently sanitise media names, which could allow cross-site scripting (XSS). An attacker must have a role that allows them to create or edit a media entity.
Am I affected?
Look for drupal/sector and its installed version in composer.lock. The advisory lists fixes in 10.3.3 and 10.4.2, but gives no affected version range. Check which roles can create or edit media entities, as an attacker needs that permission.
What to do
Check which version you have, then update to a fixed release for your branch (10.3.3, 10.4.2):
composer show drupal/sector | grep versions
composer update drupal/sectorIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement that an attacker have a role with the ability to create or edit a media entity.
The advisory's description
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.
A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-229
- The week's digest, with the other advisories from 19 Oct 2026
- All advisories for drupal/sector