EUVD-2026-43069
GHSA-vx3g-w5hr-294x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Standard reflected/stored XSS pattern: network-accessible, no attacker auth, victim interaction required, browser-scope impact with no availability loss.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
AnalysisAI
Cross-site scripting in the Drupal Canvas contributed module allows unauthenticated remote attackers to inject and execute malicious scripts in victims' browsers across multiple version branches (0.0.0-1.4.2, 1.5.0-1.5.2, 1.6.0-1.6.1, 1.7.0-1.7.1). The scope-changed CVSS vector (S:C) confirms the attack escapes the server context and executes within the victim's browser environment, enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. No public exploit or CISA KEV listing has been identified, and EPSS at 0.20% (10th percentile) reflects minimal observed exploitation activity at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-controlled input processed by the Drupal Canvas module is not adequately sanitized or escaped before being rendered in HTML output. Drupal Canvas is a contributed module for the Drupal CMS that provides visual canvas-based page building or content composition capabilities; it is not part of Drupal core. The CPE identifier cpe:2.3:a:drupal:drupal_canvas:*:*:*:*:*:*:*:* covers all platform variants of the module. The XSS class (CWE-79) typically arises when canvas element settings, user-supplied labels, or embedded content values are reflected or stored without proper HTML encoding. The S:C (Scope Changed) metric in the CVSS vector is canonical for XSS - the vulnerable component is the server-side application, while the impact materialises in the victim's browser, a distinct security scope.
RemediationAI
The primary remediation is to upgrade Drupal Canvas to a patched release per the vendor advisory at https://www.drupal.org/sa-contrib-2026-065. The patch is confirmed available from the vendor (Drupal security team), but exact fixed version numbers are not independently confirmed in the available data - consult the advisory directly to identify the correct target version for each branch (post-1.4.2, post-1.5.2, post-1.6.1, and post-1.7.1 respectively). If immediate upgrade is operationally blocked, disable the Drupal Canvas module entirely until patching is possible - this eliminates the attack surface at the cost of losing canvas-based content editing functionality. As an additional compensating control, restrict content-creation and canvas-editing permissions to trusted authenticated roles via Drupal's permission system; while the CVSS PR:N indicates no attacker authentication is required, limiting who can submit canvas input reduces the injection surface. Content Security Policy (CSP) headers configured to restrict inline script execution can reduce the impact of successful XSS, though they are not a substitute for patching.
More in Drupal Canvas
View allCross-site scripting in the Drupal Canvas contributed module enables remote attackers to inject and execute malicious sc
A Server-Side Request Forgery (SSRF) vulnerability exists in Drupal Canvas versions prior to 1.1.1, allowing attackers t
Improper authorization controls in Drupal Canvas versions before 1.0.4 enable attackers to bypass access restrictions an
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today