EUVD-2026-43077
GHSA-h2x8-8cx9-4p49
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low-privilege authentication required to inject payload (PR:L); victim must render the page (UI:R); scope changes to victim browser (S:C); no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.
AnalysisAI
Cross-site scripting in Drupal's Siteimprove Analytics contributed module (all versions before 2.0.1) allows an authenticated low-privileged attacker to inject malicious scripts that execute in a victim user's browser session. The CVSS scope change (S:C) indicates the attack crosses the application trust boundary, enabling potential session hijacking or privilege escalation against higher-privileged users such as administrators who view attacker-controlled content. No public exploit code exists and EPSS of 0.19% (8th percentile) confirms low real-world exploitation probability; no active exploitation has been identified at time of analysis.
Technical ContextAI
The Siteimprove Analytics module (CPE: cpe:2.3:a:drupal:siteimprove_analytics:*:*:*:*:*:*:*:*) is a Drupal CMS contributed module that integrates Siteimprove website analytics and content quality tooling into Drupal-based installations. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled input is insufficiently sanitized or escaped before being rendered into HTML output, allowing injected script tags or event handlers to execute in the browser of any user viewing the affected content. The CVSS metrics PR:L/UI:R/S:C are characteristic of stored or reflected XSS where an authenticated attacker plants a payload that a second victim - typically a higher-privileged user - triggers by navigating to the affected page, causing the script to run under the victim's browser session context rather than the application's server context.
RemediationAI
Upgrade the Drupal Siteimprove Analytics contributed module to version 2.0.1 or later, as directed by Drupal security advisory SA-CONTRIB-2026-073 (https://www.drupal.org/sa-contrib-2026-073). The patch is confirmed available from the vendor. If immediate patching is not feasible, disabling the Siteimprove Analytics module entirely eliminates exposure at the cost of analytics functionality. As a complementary control, configure a restrictive Content Security Policy header (script-src 'self') on the Drupal site to limit script execution sources, though this may interfere with legitimate Siteimprove script loading and requires careful testing. Additionally, restricting user registration to trusted accounts reduces the pool of potential attackers who could exploit the PR:L requirement.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today