PatchClock

PHP security digest · 21 Oct 2026

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module d...

Unrated CVE-2026-114534

Package
drupal/block_attributes
Fixed in
2.1.0
Published
Wed 21 Oct 2026, 18:46 LisbonUpdated Mon 26 Oct 2026, 07:26 Lisbon

In plain words

The module does not sufficiently sanitise custom block attributes, allowing cross-site scripting. An attacker must have the administer blocks permission to exploit this.

Am I affected?

Look for drupal/block_attributes and its version in composer.lock. The advisory lists 2.1.0 as fixed but does not specify the affected version range. Check who has the administer blocks permission, which is required to exploit the flaw.

What to do

Check which version you have, then update to a fixed release for your branch (2.1.0):

composer show drupal/block_attributes | grep versions
composer update drupal/block_attributes

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The issue is mitigated by the requirement that an attacker have the administer blocks permission.

The advisory's description

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format.

The module does not sufficiently sanitize attributes against cross site scripting.

This issue is mitigated by the fact that the attacker must have the administer blocks permission.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.