Skip to content

Commit 646a8f0

Browse files
DrupalSecurityBotgithub-actions[bot]
DrupalSecurityBot
and
github-actions[bot]
authored
feat: update advisories (#226)
🤖 beep boop - looks like there's some changes to the advisories! - https://www.drupal.org/SA-CONTRIB-2026-047 - https://www.drupal.org/SA-CONTRIB-2026-046 - https://www.drupal.org/SA-CONTRIB-2026-044 - https://www.drupal.org/SA-CONTRIB-2026-045 - https://www.drupal.org/SA-CONTRIB-2026-043 Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 428b565 commit 646a8f0

5 files changed

Lines changed: 230 additions & 0 deletions

File tree

‎advisories/bfap_sb/DRUPAL-CONTRIB-2026-047.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-047",
4+
"modified": "2026-06-10T17:10:26.000Z",
5+
"published": "2026-06-10T17:10:26.000Z",
6+
"aliases": [
7+
"CVE-2026-11915"
8+
],
9+
"details": "The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-maintainer-of-a-project-that-is-unsupported-for-security-reasons)",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/bfap_sb"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
],
25+
"database_specific": {
26+
"constraint": "*"
27+
}
28+
}
29+
],
30+
"database_specific": {
31+
"affected_versions": "*"
32+
}
33+
}
34+
],
35+
"references": [
36+
{
37+
"type": "WEB",
38+
"url": "https://www.drupal.org/sa-contrib-2026-047"
39+
}
40+
],
41+
"credits": []
42+
}

‎advisories/composer/DRUPAL-CONTRIB-2026-046.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-046",
4+
"modified": "2026-06-10T17:09:45.000Z",
5+
"published": "2026-06-10T17:09:45.000Z",
6+
"aliases": [
7+
"CVE-2026-11914"
8+
],
9+
"details": "The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-maintainer-of-a-project-that-is-unsupported-for-security-reasons)\n\n*Note: this is about a project for the Drupal system that makes use of composer. It is not a vulnerability in the composer software itself.*",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/composer"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
],
25+
"database_specific": {
26+
"constraint": "*"
27+
}
28+
}
29+
],
30+
"database_specific": {
31+
"affected_versions": "*"
32+
}
33+
}
34+
],
35+
"references": [
36+
{
37+
"type": "WEB",
38+
"url": "https://www.drupal.org/sa-contrib-2026-046"
39+
}
40+
],
41+
"credits": []
42+
}

‎advisories/examples/DRUPAL-CONTRIB-2026-044.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-044",
4+
"modified": "2026-06-10T17:07:55.000Z",
5+
"published": "2026-06-10T17:07:55.000Z",
6+
"aliases": [
7+
"CVE-2026-11909"
8+
],
9+
"details": "The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality.\n\nThe \"Read from a file\" feature implemented by the file\\_example submodule can be used to expose any file that PHP can access. Therefore, the file\\_example sub-module is being removed from Examples for Developers until a version demonstrating file security best practices can be added back in the future. Developers who based a new module on this example should review their code for an access bypass.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/examples"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "4.0.6"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<4.0.6"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<4.0.6"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-044"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Pierre Rudloff (prudloff)",
47+
"contact": [
48+
"https://www.drupal.org/u/prudloff"
49+
]
50+
}
51+
]
52+
}

‎advisories/mothermayi/DRUPAL-CONTRIB-2026-045.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-045",
4+
"modified": "2026-06-10T17:08:53.000Z",
5+
"published": "2026-06-10T17:08:53.000Z",
6+
"aliases": [
7+
"CVE-2026-11913"
8+
],
9+
"details": "The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-maintainer-of-a-project-that-is-unsupported-for-security-reasons)",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/mothermayi"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
],
25+
"database_specific": {
26+
"constraint": "*"
27+
}
28+
}
29+
],
30+
"database_specific": {
31+
"affected_versions": "*"
32+
}
33+
}
34+
],
35+
"references": [
36+
{
37+
"type": "WEB",
38+
"url": "https://www.drupal.org/sa-contrib-2026-045"
39+
}
40+
],
41+
"credits": []
42+
}

‎advisories/tagify/DRUPAL-CONTRIB-2026-043.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-043",
4+
"modified": "2026-06-10T17:07:12.000Z",
5+
"published": "2026-06-10T17:07:12.000Z",
6+
"aliases": [
7+
"CVE-2026-11908"
8+
],
9+
"details": "This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets.\n\nThe module does not properly sanitise the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the user\u2019s session.\n\nThe vulnerability is mitigated by the fact an attacker must have a role with permission to create or edit taxonomy terms in a vocabulary.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/tagify"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.2.52"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.2.52"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<1.2.52"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-043"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Pierre Rudloff (prudloff)",
47+
"contact": [
48+
"https://www.drupal.org/u/prudloff"
49+
]
50+
}
51+
]
52+
}

0 commit comments

Comments
 (0)