EUVD-2026-66208
GHSA-jjcr-jhm4-rpqw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS requires no attacker privileges (PR:N) but mandatory victim interaction (UI:R); scope change (S:C) reflects JavaScript execution in the victim's browser beyond the application boundary, with no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.
AnalysisAI
Reflected XSS in the Drupal Search API Autocomplete contributed module (versions 0.0.0 through 1.12.0) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in the context of victims' browsers when they are socially engineered into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script executes outside the application's security zone - in the victim's browser - enabling session token theft or authenticated action hijacking. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target Drupal site must have the Search API Autocomplete contributed module installed and enabled at a version from 0.0.0 to less than 1.12.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 medium score accurately reflects a network-accessible (AV:N), low-complexity (AC:L) attack with no attacker authentication required (PR:N) but mandatory victim interaction (UI:R) - a prerequisite that substantially limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Search API Autocomplete module to version 1.12.0 or later, as directed by Drupal Security Advisory SA-CONTRIB-2026-082 available at https://www.drupal.org/sa-contrib-2026-082; this can be performed via Composer (composer update drupal/search_api_autocomplete) or through the Drupal administrative update interface. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Search Api Autocomplete
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today