Drupal Canvas CVE-2026-58587

Exploitation requires that the target Drupal installation has the Drupal Canvas contributed module installed and enabled, running one of the affected version ranges (0.0.0-1.4.2, 1.5.0-1.5.2, 1.6.0-1.6.1, or 1.7.0-1.7.1). The CVSS vector (PR:N) confirms the attacker does not need to be authenticated to craft or deliver the malicious payload. However, UI:R confirms that a victim user must take an action - such as loading a page, following a link, or previewing canvas content - for the injected script to execute. Exploitation is strictly limited to Drupal sites with this specific contributed module; sites running Drupal core without this module are entirely unaffected. The specific canvas input field or rendering context that lacks output encoding is not detailed in available data and should be confirmed via the vendor advisory.

The CVSS 6.1 Medium score reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated attacker path (PR:N) with required victim interaction (UI:R) and scope change (S:C), yielding low confidentiality and integrity impacts. EPSS at 0.20% (10th percentile) is notably low, indicating limited observed exploitation in the wild despite broad exposure. There is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low-urgency but genuine risk for affected deployments. Because this is a contributed module rather than Drupal core, the real-world attack surface is constrained to the subset of Drupal sites that have explicitly installed Drupal Canvas - significantly narrowing the population at risk compared to a core Drupal vulnerability. For those sites, however, the absence of privilege requirements on the attacker side and the potential for session hijacking makes patching a genuine priority. CVSS signals and EPSS are broadly consistent: a real but not yet actively exploited medium-severity flaw.

An attacker identifies a Drupal site running an affected version of the Canvas module and crafts a payload embedding malicious JavaScript within a canvas field or parameter that is stored or reflected without sanitization. The attacker then socially engineers a site user - such as an editor or administrator - into loading a page or preview URL containing the injected script, causing the script to execute in the victim's browser and exfiltrate their session cookie or perform authenticated actions on their behalf. No public proof-of-concept code has been identified at time of analysis, but the attack technique is well-understood for CWE-79 class vulnerabilities.