Skip to content

Commit 7a02011

Browse files
DrupalSecurityBotgithub-actions[bot]
DrupalSecurityBot
and
github-actions[bot]
authored
feat: update advisories (#228)
🤖 beep boop - looks like there's some changes to the advisories! - https://www.drupal.org/SA-CORE-2026-001 - https://www.drupal.org/SA-CORE-2026-005 - https://www.drupal.org/SA-CORE-2026-006 - https://www.drupal.org/SA-CORE-2026-007 - https://www.drupal.org/SA-CORE-2026-008 - https://www.drupal.org/SA-CORE-2026-009 - https://www.drupal.org/SA-CONTRIB-2026-049 - https://www.drupal.org/SA-CONTRIB-2026-048 - https://www.drupal.org/SA-CONTRIB-2026-050 Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 85e86e8 commit 7a02011

9 files changed

Lines changed: 852 additions & 2 deletions

‎advisories/core/DRUPAL-CORE-2026-001.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.7.0",
33
"id": "DRUPAL-CORE-2026-001",
4-
"modified": "2026-04-15T19:24:30.000Z",
4+
"modified": "2026-06-12T13:37:18.000Z",
55
"published": "2026-04-15T19:24:30.000Z",
66
"aliases": [
77
"CVE-2026-6365"
88
],
9-
"details": "Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which which can lead to a cross-site scripting (XSS) vulnerability.",
9+
"details": "Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability.",
1010
"affected": [
1111
{
1212
"package": {

‎advisories/core/DRUPAL-CORE-2026-005.json‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CORE-2026-005",
4+
"modified": "2026-06-17T18:48:57.000Z",
5+
"published": "2026-06-05T10:53:09.000Z",
6+
"aliases": [
7+
"CVE-2026-55803"
8+
],
9+
"details": "[SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) added protection for fields that store serialized data to disallow direct writes via web services.\n\nThe above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain rare circumstances, potentially resulting in PHP Object Injection.\n\nThis vulnerability is mitigated by the fact that in order to be exploitable:\n\n* A site must use an entity reference field type that stores a serialized property.\n* An attacker must have permission to write to the entity via JSON:API.\n\nNo field type shipped with Drupal core meets these criteria, and contributed or user-created field types that do appear to be extremely unusual. This update protects all such fields; no changes are required in contributed modules.\n\nJSON:API is read-only by default, so sites are only affected if they have enabled write access (either through administrator configuration or the installation of a contributed or custom module that enables write access).\n\n#### Drupal Steward protection:\n\nThis issue is being protected by [Drupal Steward](https://www.drupal.org/steward). In this instance, we believe that the WAF rule will provide mitigation for the common/obvious vulnerability paths, but may not be able to cover all cases or work for all hosting providers. Additionally, several other core security advisories released today are *not* mitigated by Drupal Steward. Therefore, our recommended action is still to plan an actual Drupal update within 24 hours of this release.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/core"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "10.5.12"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<10.5.12"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "10.6.0"
37+
},
38+
{
39+
"fixed": "10.6.11"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=10.6.0 <10.6.11"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.2.0"
51+
},
52+
{
53+
"fixed": "11.2.14"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=11.2.0 <11.2.14"
58+
}
59+
},
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "11.3.0"
65+
},
66+
{
67+
"fixed": "11.3.12"
68+
}
69+
],
70+
"database_specific": {
71+
"constraint": ">=11.3.0 <11.3.12"
72+
}
73+
},
74+
{
75+
"type": "ECOSYSTEM",
76+
"events": [
77+
{
78+
"introduced": "11.0.0"
79+
},
80+
{
81+
"fixed": "11.1.0"
82+
}
83+
],
84+
"database_specific": {
85+
"constraint": "11.0.*"
86+
}
87+
},
88+
{
89+
"type": "ECOSYSTEM",
90+
"events": [
91+
{
92+
"introduced": "11.1.0"
93+
},
94+
{
95+
"fixed": "11.2.0"
96+
}
97+
],
98+
"database_specific": {
99+
"constraint": "11.1.*"
100+
}
101+
}
102+
],
103+
"database_specific": {
104+
"affected_versions": "<10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*"
105+
}
106+
}
107+
],
108+
"references": [
109+
{
110+
"type": "WEB",
111+
"url": "https://www.drupal.org/sa-core-2026-005"
112+
}
113+
],
114+
"credits": [
115+
{
116+
"name": "Michael Maturi (michaelmaturi)",
117+
"contact": [
118+
"https://www.drupal.org/u/michaelmaturi"
119+
]
120+
}
121+
]
122+
}

‎advisories/core/DRUPAL-CORE-2026-006.json‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CORE-2026-006",
4+
"modified": "2026-06-17T18:38:57.000Z",
5+
"published": "2026-06-08T01:03:55.000Z",
6+
"aliases": [
7+
"CVE-2026-55804"
8+
],
9+
"details": "Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called \"gadget chain\" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.\n\nThis issue is not directly exploitable.\n\nThis issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to `unserialize()`.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/core"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "10.5.12"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<10.5.12"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "10.6.0"
37+
},
38+
{
39+
"fixed": "10.6.11"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=10.6.0 <10.6.11"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.2.0"
51+
},
52+
{
53+
"fixed": "11.2.14"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=11.2.0 <11.2.14"
58+
}
59+
},
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "11.3.0"
65+
},
66+
{
67+
"fixed": "11.3.12"
68+
}
69+
],
70+
"database_specific": {
71+
"constraint": ">=11.3.0 <11.3.12"
72+
}
73+
},
74+
{
75+
"type": "ECOSYSTEM",
76+
"events": [
77+
{
78+
"introduced": "11.0.0"
79+
},
80+
{
81+
"fixed": "11.1.0"
82+
}
83+
],
84+
"database_specific": {
85+
"constraint": "11.0.*"
86+
}
87+
},
88+
{
89+
"type": "ECOSYSTEM",
90+
"events": [
91+
{
92+
"introduced": "11.1.0"
93+
},
94+
{
95+
"fixed": "11.2.0"
96+
}
97+
],
98+
"database_specific": {
99+
"constraint": "11.1.*"
100+
}
101+
}
102+
],
103+
"database_specific": {
104+
"affected_versions": "<10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*"
105+
}
106+
}
107+
],
108+
"references": [
109+
{
110+
"type": "WEB",
111+
"url": "https://www.drupal.org/sa-core-2026-006"
112+
}
113+
],
114+
"credits": [
115+
{
116+
"name": "Michael Maturi (michaelmaturi)",
117+
"contact": [
118+
"https://www.drupal.org/u/michaelmaturi"
119+
]
120+
}
121+
]
122+
}

‎advisories/core/DRUPAL-CORE-2026-007.json‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CORE-2026-007",
4+
"modified": "2026-06-17T18:56:13.000Z",
5+
"published": "2026-06-17T18:56:13.000Z",
6+
"aliases": [
7+
"CVE-2026-55806"
8+
],
9+
"details": "Drupal core ships a `rebuild.php` front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition.\n\nThis script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cache poisoning or a redirect to an attacker-controlled domain.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/core"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "10.5.12"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<10.5.12"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "10.6.0"
37+
},
38+
{
39+
"fixed": "10.6.11"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=10.6.0 <10.6.11"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.2.0"
51+
},
52+
{
53+
"fixed": "11.2.14"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=11.2.0 <11.2.14"
58+
}
59+
},
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "11.3.0"
65+
},
66+
{
67+
"fixed": "11.3.12"
68+
}
69+
],
70+
"database_specific": {
71+
"constraint": ">=11.3.0 <11.3.12"
72+
}
73+
},
74+
{
75+
"type": "ECOSYSTEM",
76+
"events": [
77+
{
78+
"introduced": "11.0.0"
79+
},
80+
{
81+
"fixed": "11.1.0"
82+
}
83+
],
84+
"database_specific": {
85+
"constraint": "11.0.*"
86+
}
87+
},
88+
{
89+
"type": "ECOSYSTEM",
90+
"events": [
91+
{
92+
"introduced": "11.1.0"
93+
},
94+
{
95+
"fixed": "11.2.0"
96+
}
97+
],
98+
"database_specific": {
99+
"constraint": "11.1.*"
100+
}
101+
}
102+
],
103+
"database_specific": {
104+
"affected_versions": "<10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*"
105+
}
106+
}
107+
],
108+
"references": [
109+
{
110+
"type": "WEB",
111+
"url": "https://www.drupal.org/sa-core-2026-007"
112+
}
113+
],
114+
"credits": [
115+
{
116+
"name": "Melih Acikoz",
117+
"contact": [
118+
"https://www.drupal.org/u/melih-acikoz"
119+
]
120+
},
121+
{
122+
"name": "Michael Winser (michaelwinser)",
123+
"contact": [
124+
"https://www.drupal.org/u/michaelwinser"
125+
]
126+
},
127+
{
128+
"name": "Willem Drupal enthousiast (willempje2)",
129+
"contact": [
130+
"https://www.drupal.org/u/willempje2"
131+
]
132+
}
133+
]
134+
}

0 commit comments

Comments
 (0)