The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocompl...

The Country module does not sufficiently escape user input in its autocomplete widget, which can allow an attacker to run script in a user's browser. This cannot happen with the Country module alone out of the box: additional modules or custom code are required.

Look for drupal/country and its version in composer.lock. The advisory lists fixes in 2.1.3 and 2.2.1, but gives no affected version range. Check whether your project uses the Country autocomplete widget with additional modules or custom code; the advisory does not specify which modules or code make it vulnerable.

The issue cannot occur with the Country module alone out of the box; additional modules or custom code are required.

The module Country provides a dedicated field type for Drupal core's official country list.

The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability.

This vulnerability is mitigated by the fact that it can not occur out of the box with the Country module, additional module(s) or custom code is required.