Drupal Country CVE-2026-107308

Exploitation is limited by three stacked prerequisites reflected in the CVSS vector: the attacker must hold high privileges on the target Drupal site (PR:H), a victim must be induced to interact with the malicious content (UI:R), and attack complexity is high (AC:H), meaning conditions outside the attacker's control must be met. The affected component is the Drupal 'Country' contrib module at versions 0.0.0-2.1.2 and 2.2.0, so the site must have this specific module installed and enabled at a vulnerable version. The exact feature or field that fails to neutralize input is not described in the available sources. These factors together make opportunistic or mass exploitation unlikely.

This is a low-severity issue (CVSS 3.1 base score 3.1) that does not represent an urgent priority. Multiple independent signals agree: EPSS is 0.16% (5th percentile), the CISA SSVC framework records Exploitation=none, Automatable=no, and only partial Technical Impact, and vuln.today assigns a 'monitor' decision label - the lowest urgency tier. The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) reinforces this: although the attack vector is network-based, exploitation requires high privileges (PR:H), user interaction (UI:R), and high attack complexity (AC:H), with only limited confidentiality and integrity impact and no availability impact. There is no KEV listing and no public exploit identified at time of analysis - only a vendor advisory reference. The signals are therefore consistent rather than conflicting: a genuinely low real-world risk, not a high-CVSS-but-overstated issue. One caveat: the AC:H and PR:H values in the supplied vector are unusually high for a web XSS flaw, and the description does not explain the trigger, so the exact preconditions should be confirmed against the Drupal advisory (SA-CONTRIB-2026-211).

An authenticated attacker who already holds a high-privilege role on a Drupal site running a vulnerable Country module version injects a crafted payload that is later rendered unsanitized in a web page; when another user views that page, attacker-controlled script executes in their browser session. No public exploit code has been identified, and the specific injection point is not described in the available sources.