---
id: CVE-2026-108514
title: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
summary: >-
  Improper Neutralization of Input During Web Page Generation ("Cross-site
  Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting
  (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from
  11.0.0 to 1…
severity: none
cwe:
  - CWE-79
vendor: Drupal
product: Drupal core
affected:
  - core >= 10.3.0 < 10.6.19
  - core >= 11.0.0 < 11.3.19
  - core >= 11.4.0 < 11.4.10
  - core >= 12.0.0-alpha1 < 12.0.0-beta2
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T03:09:51.346Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-108514'
references:
  - url: 'https://www.drupal.org/sa-core-2026-016'
tags:
  - cve.org
epss: 0.00197
epssPercentile: 0.0953
ingestedAt: '2026-11-03T10:42:03.620Z'
---

## Overview

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

## Affected

- `core >= 10.3.0 < 10.6.19`
- `core >= 11.0.0 < 11.3.19`
- `core >= 11.4.0 < 11.4.10`
- `core >= 12.0.0-alpha1 < 12.0.0-beta2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.