PatchClock

PHP security digest · 9 Sep 2026

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles...

Unrated CVE-2026-87942

Package
drupal/safedelete
Fixed in
1.0.88
Published
Wed 9 Sep 2026, 18:19 LisbonUpdated Sun 25 Oct 2026, 23:25 Lisbon

In plain words

The module does not sufficiently sanitise node titles in the orphaned nodes report, allowing persistent cross-site scripting (XSS) when the report is viewed. An attacker must have permission to create content of a content type configured for that report.

Am I affected?

Look for drupal/safedelete and its version in composer.lock. The advisory lists 1.0.88 as fixed but gives no affected version range. Check which content types are configured for the orphaned nodes report and who has permission to create content of those types.

What to do

Check which version you have, then update to a fixed release for your branch (1.0.88):

composer show drupal/safedelete | grep versions
composer update drupal/safedelete

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by the requirement that an attacker must have permission to create content of a content type configured for the orphaned nodes report.

The advisory's description

This module enables you to manage content deletion and provides reports for identifying orphaned content.

The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability (XSS).

This vulnerability is mitigated by the fact that an attacker must have permission to create content of a content type configured for the orphaned nodes report.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.