EUVD-2026-43070
GHSA-4jgx-vqf2-p9g9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS needs no attacker auth (PR:N) but requires victim interaction (UI:R); scope change (S:C) captures cross-context script execution in victim browser; no server-side confidentiality or availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
AnalysisAI
Cross-site scripting in the Drupal Canvas contributed module enables remote attackers to inject and execute malicious scripts in the browsers of Drupal site visitors. Affecting multiple version branches - 0.0.0 through 1.4.2, 1.5.0 through 1.5.2, 1.6.0 through 1.6.1, and 1.7.0 through 1.7.1 - the flaw (CWE-79) stems from insufficient sanitization of user-supplied input before rendering it in generated web pages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.20% (10th percentile) reflects minimal current exploitation activity.
Technical ContextAI
Drupal Canvas is a contributed module for the Drupal CMS, extending its content-building capabilities. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of vulnerability where attacker-controlled input is incorporated into HTML output without adequate escaping or encoding, causing browsers to interpret it as executable script. The CVSS scope change (S:C) indicates the injected payload executes in the victim's browser context - a domain outside the vulnerable server component itself - enabling actions such as session token exfiltration or DOM manipulation. The CPE string cpe:2.3:a:drupal:drupal_canvas confirms this affects the Canvas contributed module specifically, not Drupal core, limiting exposure to sites that have explicitly installed this module.
RemediationAI
A patch is available per vendor advisory - site administrators should consult the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-066 to identify the precise fixed release for their active version branch and upgrade accordingly; exact patched version numbers are not confirmed in the available data and must be verified in the advisory. If immediate patching is not feasible, the most effective compensating control is to disable the Drupal Canvas module entirely (Administration > Extend), accepting loss of its layout/canvas functionality as a trade-off; this eliminates the attack surface without requiring code changes. Restricting access to Canvas-rendered pages to authenticated users only may reduce exposure for some deployment configurations, but does not eliminate the vulnerability since PR:N means an authenticated victim is still susceptible if tricked into loading a crafted URL.
More in Drupal Canvas
View allCross-site scripting in the Drupal Canvas contributed module allows unauthenticated remote attackers to inject and execu
A Server-Side Request Forgery (SSRF) vulnerability exists in Drupal Canvas versions prior to 1.1.1, allowing attackers t
Improper authorization controls in Drupal Canvas versions before 1.0.4 enable attackers to bypass access restrictions an
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today