PatchClock

PHP security digest · 9 Sep 2026

The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or saniti...

Unrated CVE-2026-87939

Package
drupal/feed_block
Fixed in
2.0.2, 3.0.2
Published
Wed 9 Sep 2026, 18:16 LisbonUpdated Sun 25 Oct 2026, 23:25 Lisbon

In plain words

The Feed Block module does not sufficiently validate or sanitise the RSS feed it generates, allowing stored cross-site scripting (XSS). This can allow attacker-controlled script to run in a user's browser when affected feed content is displayed.

Am I affected?

Look for drupal/feed_block and its version in composer.lock. The advisory lists 2.0.2 and 3.0.2 as fixed but gives no affected version range, so it does not establish which other versions are affected. The version is all there is to check: the description names no additional configuration, feature or database condition.

What to do

Check which version you have, then update to a fixed release for your branch (2.0.2, 3.0.2):

composer show drupal/feed_block | grep versions
composer update drupal/feed_block

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed.

The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.