Drupal Core CVE-2026-6367

Exploitation requires a victim user to actively interact with attacker-controlled content - clicking a crafted link, submitting a manipulated form, or visiting a page that triggers the vulnerable rendering path - confirmed by the CVSS UI:R indicator. This mandatory interaction prevents fully automated or worm-like exploitation. The attack vector is Network (AV:N) with Low complexity (AC:L) and no required privileges (PR:N), so the attacker needs no account on the target Drupal site. Exploitation is strictly limited to sites running Drupal core 11.3.0 through 11.3.6; installations on other version branches (e.g., 10.x) are not affected by this CVE. The exact Drupal core feature or rendering subsystem that must be active is not specified in available data - review SA-CORE-2026-003 for confirmation of whether non-default configurations narrow the attack surface further.

The CVSS Medium score of 6.1 reflects network reachability and low attack complexity offset by mandatory user interaction (UI:R) and no availability impact. The Changed scope (S:C) elevates the score over typical same-origin XSS by acknowledging cross-boundary impact on the victim's browser session. However, EPSS at 0.03% (8th percentile) signals an extremely low observed exploitation probability - well below thresholds associated with active campaigns. There is no CISA KEV listing and no POC referenced in the available data, making this a patched vulnerability with limited real-world exploitation signals. The primary residual risk is opportunistic targeting of unpatched Drupal 11.3.x deployments, particularly where XSS payloads could reach high-privilege sessions such as administrator accounts. The UI:R requirement meaningfully limits fully automated mass exploitation. Overall, this is a real but moderate-priority issue: patch promptly, but it does not warrant emergency response absent KEV confirmation.

An attacker identifies a Drupal 11.3.0-11.3.6 site and crafts a URL or form input embedding a JavaScript payload that exploits the unsanitized rendering path in Drupal core. The attacker delivers this link via phishing email or social engineering to a target user - ideally an administrator - who clicks it, causing their browser to execute the malicious script within the Drupal application's origin context. The script exfiltrates the victim's session cookie or CSRF token to an attacker-controlled server, enabling account takeover without needing direct server access. No public POC has been identified at time of analysis.