EUVD-2026-43079
GHSA-rx7v-qfjw-hc2q
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible stored XSS requiring low-privileged submission and victim interaction; scope changed to browser, with limited confidentiality and integrity impact only.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.
AnalysisAI
Stored XSS in the Drupal UI Patterns (SDC in Drupal UI) contributed module allows a low-privileged authenticated attacker to inject persistent malicious scripts into web pages, which execute in the browsers of other users - including administrators - who view the affected content. Versions 2.0.0 through 2.0.17 of the module are affected, with a patch available from the Drupal security team. No public exploit identified at time of analysis, and the EPSS score of 0.25% (17th percentile) signals minimal observed exploitation pressure, though the stored nature of the XSS and potential to target privileged users elevates practical risk for sites using this module.
Technical ContextAI
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical stored XSS root cause: user-supplied input is accepted and persisted without adequate sanitization or output encoding, then later rendered into HTML pages without escaping. The affected component is the UI Patterns module for Drupal, specifically the SDC (Single Directory Components) integration - a contributed module that provides a pattern library and component system for Drupal theming. The CPE string cpe:2.3:a:drupal:ui_patterns_(sdc_in_drupal_ui) confirms the scope is the contributed module, not Drupal core. The CVSS scope metric S:C indicates the vulnerability crosses the security boundary from the application server into victims' browser contexts, characteristic of XSS attacks.
RemediationAI
Upgrade the Drupal UI Patterns (SDC in Drupal UI) module to version 2.0.17 or later, per the vendor advisory at https://www.drupal.org/sa-contrib-2026-075. Note: there is a minor version ambiguity between the NVD description (which lists 2.0.17 as affected) and the EUVD record (which lists '<2.0.17' as the affected range, implying 2.0.17 is fixed) - consult the Drupal advisory directly to confirm the exact fix version before deploying. As a compensating control while patching, restrict content authoring permissions to trusted users only, limiting who can submit input that passes through the vulnerable rendering path. Enabling Drupal's content security policy headers can reduce XSS impact by restricting script execution origins, though this is not a substitute for patching. Review any user-submitted content stored through this module for signs of injected script payloads.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today