PHP security digest · Packages

drupal/country security advisories

1 advisory we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

Not rated 7 Oct 2026

The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocompl...

Fixed in 2.1.3, 2.2.1 · CVE-2026-107308

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including drupal/country, and the version that fixes it.