EUVD-2026-69994
GHSA-h52g-f94f-r87h
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
PR:H confirmed because only high-privileged admins can store payload; S:C reflects XSS executing in victim browser context.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.
AnalysisAI
Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker holds high-privilege access to the Drupal administrative interface - specifically, permission to configure Entity Browser widgets or create content through Entity Browser-enabled workflows. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 4.8 accurately reflects the constrained real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the Drupal Entity Browser module to version 2.16.0 or later, as documented in vendor advisory SA-CONTRIB-2026-094 at https://www.drupal.org/sa-contrib-2026-094. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today