EUVD-2026-43077
GHSA-h2x8-8cx9-4p49
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low-privilege authentication required to inject payload (PR:L); victim must render the page (UI:R); scope changes to victim browser (S:C); no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.
AnalysisAI
Cross-site scripting in Drupal's Siteimprove Analytics contributed module (all versions before 2.0.1) allows an authenticated low-privileged attacker to inject malicious scripts that execute in a victim user's browser session. The CVSS scope change (S:C) indicates the attack crosses the application trust boundary, enabling potential session hijacking or privilege escalation against higher-privileged users such as administrators who view attacker-controlled content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid, authenticated Drupal account with at least low-level permissions (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score reflects meaningful but bounded risk: the attack requires prior authentication (PR:L) and victim user interaction (UI:R), limiting opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Drupal user with a low-privilege account submits a crafted payload containing malicious JavaScript through an input field or configuration surface handled by the Siteimprove Analytics module. When an administrator or editor later navigates to the page that renders the tainted content, the injected script executes silently in their browser, potentially exfiltrating the admin's session cookie to an attacker-controlled endpoint or performing privileged CMS actions on their behalf. … |
| Remediation | Upgrade the Drupal Siteimprove Analytics contributed module to version 2.0.1 or later, as directed by Drupal security advisory SA-CONTRIB-2026-073 (https://www.drupal.org/sa-contrib-2026-073). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today