EUVD-2026-43049
GHSA-92rg-hv8v-hrc3
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS submitted over the network by a low-privilege authenticated user; victim must render the page (UI:R); scope changes to victim browser context with limited confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.
AnalysisAI
Stored cross-site scripting in the Drupal Tagify contributed module allows low-privileged authenticated users to inject persistent malicious scripts that execute in the browsers of subsequent page visitors, including administrators. All Tagify module versions prior to 1.2.52 are affected. No public exploit code has been identified and EPSS sits at the 6th percentile, but the stored nature of the XSS elevates impact relative to reflected variants since payloads persist across all future viewers of the poisoned content.
Technical ContextAI
Drupal Tagify (CPE: cpe:2.3:a:drupal:tagify:*:*:*:*:*:*:*:*) is a contributed Drupal module providing tag-input UI widgets for content editing forms. The root cause is CWE-79 - Improper Neutralization of Input During Web Page Generation - specifically its stored variant: user-supplied tag values are written to the Drupal database without sufficient sanitization or context-aware output encoding, then rendered verbatim during subsequent page generation. The CVSS Scope:Changed metric reflects the cross-context nature of XSS - the injected script executes in the victim's browser session context rather than on the Drupal server, crossing a security boundary between the application and the victim's user agent.
RemediationAI
Upgrade the Drupal Tagify module to version 1.2.52 or later, which contains the vendor-released patch per the security advisory at https://www.drupal.org/sa-contrib-2026-043. Upgrades can be applied via Drush (drush up tagify) or through the Drupal admin interface at /admin/modules/update. If immediate upgrade is not feasible, restrict access to all content editing forms using the Tagify widget to fully trusted, verified users only by tightening Drupal role permissions - note this may limit editorial workflows. As a more disruptive fallback, the Tagify module can be temporarily disabled (/admin/modules), which will remove tag input functionality from any content type configured to use it but eliminates the attack surface while a maintenance window is arranged.
This affects the package @yaireo/tagify before 4.9.8. Rated medium severity (CVSS 5.4), this vulnerability is remotely e
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today