PatchClock

PHP security digest · 14 Oct 2026

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mit...

Unrated CVE-2026-108514

Package
drupal/core
Fixed in
10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
Published
Wed 14 Oct 2026, 18:25 LisbonUpdated Mon 26 Oct 2026, 05:25 Lisbon
Installs on Packagist
71M

In plain words

Insufficient sanitisation of certain attributes in Drupal's Navigation module can lead to cross-site scripting (XSS). An attacker must have a role permitted to enter HTML tags containing specific data attributes, or have the administer menu permission.

Am I affected?

Find drupal/core and its version in composer.lock. The advisory lists fixes in 10.6.19, 11.3.19, 11.4.10 and 12.0.0-beta2, but gives no affected version ranges. Check whether your project uses the Navigation module, then review roles for permission to enter HTML tags containing specific data attributes or the administer menu permission.

What to do

Check which version you have, then update to a fixed release for your branch (10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2):

composer show drupal/core | grep versions
composer update drupal/core

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory identifies a mitigating condition: an attacker must have a role permitted to enter HTML tags containing specific data attributes, or have the administer menu permission.

The advisory's description

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.