Menu Link Attributes CVE-2026-107306

Exploitation requires an authenticated account with the Drupal permission needed to create or edit menu links and set their attributes via the Menu Link Attributes module (reflected as PR:H in the CVSS vector). The attacker stores a script payload in a menu link attribute field; it then executes when any user who renders that menu loads the affected page. Limiting factors: the privileged permission requirement means only trusted/administrative roles can plant the payload, which substantially constrains realistic exploitation to insider-type or compromised-privileged-account scenarios; only deployments running Menu Link Attributes versions from 0.0.0 up to but not including 1.8.0 are affected. The specific attribute field and the exact permission name are not detailed in the available sources.

This is a genuinely low-priority issue despite being network-reachable. The signals are consistent rather than conflicting: the CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) yields only 3.8 (Low) because exploitation requires high privileges (PR:H) and impact is partial (C:L/I:L, no availability). EPSS is 0.16% (5th percentile), KEV status is not listed, and the SSVC framework reports Exploitation: none, Automatable: no, Technical Impact: partial. The vuln.today decision label is 'monitor'. All independent signals agree this is not under active exploitation and is unlikely to be mass-exploited, consistent with a stored XSS that depends on a privileged account to plant the payload. The main caveat is that the raw description does not specify which Drupal permission is required to set menu link attributes, so the PR:H assumption cannot be independently confirmed from the text alone; the referenced Drupal advisory (SA-contrib-2026-209) should be consulted to confirm the exact permission. No special caveats about data conflicts otherwise - this is a real but low-severity hardening fix, not an emergency.

An authenticated Drupal user who holds the privileged permission to configure menu links edits a menu link's attributes and stores a malicious script payload in one of the attribute fields. When another user - potentially an administrator - later views a page that renders that menu, the script executes in their browser session, enabling actions such as session/cookie theft or performing requests as the victim. No public exploit code was identified in the provided sources.