Drupal Core EUVD-2026-43085

Exploitation requires the attacker to hold at least a low-privilege authenticated account on the Drupal site - a role with permission to create or edit content (e.g., anonymous content submission is insufficient per PR:L in the CVSS vector). A second prerequisite is victim interaction (UI:R): a higher-privileged user must view or navigate to the page or node containing the injected payload. The specific Drupal core feature, content type, input format, or text filter configuration that fails to neutralize the input is not identified in the available data, meaning the precise trigger condition within a Drupal installation cannot be confirmed without vendor clarification. Exploitation is limited to: (1) sites where non-administrative authenticated roles exist and are granted content-creation or editing permissions, (2) Drupal instances running one of the affected version branches, and (3) scenarios where a privileged user can be directed to the malicious content. Fully static or read-only Drupal deployments with no authenticated contributors are not exploitable.

The overall CVSS base score of 5.4 (Medium) is appropriate given the PR:L and UI:R constraints that meaningfully gate exploitation. An attacker must hold at least a low-privilege authenticated account and must induce a victim to view or interact with the malicious content - two friction points that limit opportunistic mass exploitation. EPSS at 0.15% (5th percentile) corroborates this low automated-exploitation probability and the vulnerability is not listed in CISA KEV, meaning confirmed active exploitation in the wild has not been recorded. No public proof-of-concept exploit was identified in the provided data. However, the S:C scope change elevates the actual attacker impact beyond a simple content injection: a successful exploit can capture session tokens or force authenticated actions on behalf of a higher-privileged user, making account takeover and privilege escalation realistic outcomes. The breadth of affected version ranges - spanning both 10.x and 11.x branches including the apparently fully-affected 11.0.x and 11.1.x lines - increases aggregate exposure. Real-world priority should be moderate-high for internet-exposed Drupal sites with user-generated content or multi-role environments; lower for read-only or intranet deployments with tightly controlled contributor access.

An authenticated contributor or editor-level Drupal user crafts a page, node, or field value containing an obfuscated JavaScript payload that bypasses Drupal's input filtering due to the unpatched CWE-79 flaw, then saves it to the site. When an administrator or another privileged user navigates to that content in their browser, the injected script silently executes, exfiltrates the victim's session cookie to an attacker-controlled server, and replays it to assume full administrative control of the Drupal site. No public exploit code was identified at time of analysis, but the standard technique for stored XSS in CMS platforms is well-documented in public offensive security literature.