Skip to content

Commit b33e435

Browse files
DrupalSecurityBotgithub-actions[bot]
DrupalSecurityBot
and
github-actions[bot]
authored
feat: update advisories (#246)
🤖 beep boop - looks like there's some changes to the advisories! - https://www.drupal.org/SA-CORE-2026-010 - https://www.drupal.org/SA-CORE-2026-011 - https://www.drupal.org/SA-CORE-2026-012 Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 067facf commit b33e435

3 files changed

Lines changed: 324 additions & 0 deletions

File tree

‎advisories/core/DRUPAL-CORE-2026-010.json‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CORE-2026-010",
4+
"modified": "2026-07-15T19:50:24.000Z",
5+
"published": "2026-07-15T19:50:24.000Z",
6+
"aliases": [
7+
"CVE-2026-15916"
8+
],
9+
"details": "The Image module allows you to define and configure image fields.\n\nThe module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than `private://`.\n\nThis vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.\n\nInformation disclosure issues like this one are not generally given security advisories (as described in [PSA-2023-07-12)](https://www.drupal.org/psa-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/core"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "10.6.13"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<10.6.13"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "11.3.0"
37+
},
38+
{
39+
"fixed": "11.3.14"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=11.3.0 <11.3.14"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.4.0"
51+
},
52+
{
53+
"fixed": "11.4.4"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=11.4.0 <11.4.4"
58+
}
59+
},
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "11.0.0"
65+
},
66+
{
67+
"fixed": "11.1.0"
68+
}
69+
],
70+
"database_specific": {
71+
"constraint": "11.0.*"
72+
}
73+
},
74+
{
75+
"type": "ECOSYSTEM",
76+
"events": [
77+
{
78+
"introduced": "11.1.0"
79+
},
80+
{
81+
"fixed": "11.2.0"
82+
}
83+
],
84+
"database_specific": {
85+
"constraint": "11.1.*"
86+
}
87+
},
88+
{
89+
"type": "ECOSYSTEM",
90+
"events": [
91+
{
92+
"introduced": "11.2.0"
93+
},
94+
{
95+
"fixed": "11.3.0"
96+
}
97+
],
98+
"database_specific": {
99+
"constraint": "11.2.*"
100+
}
101+
}
102+
],
103+
"database_specific": {
104+
"affected_versions": "<10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*"
105+
}
106+
}
107+
],
108+
"references": [
109+
{
110+
"type": "WEB",
111+
"url": "https://www.drupal.org/sa-core-2026-010"
112+
}
113+
],
114+
"credits": [
115+
{
116+
"name": "offensive-ai",
117+
"contact": [
118+
"https://www.drupal.org/u/offensive-ai"
119+
]
120+
}
121+
]
122+
}

‎advisories/core/DRUPAL-CORE-2026-011.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CORE-2026-011",
4+
"modified": "2026-07-15T19:51:57.000Z",
5+
"published": "2026-07-15T19:51:57.000Z",
6+
"aliases": [
7+
"CVE-2026-15917"
8+
],
9+
"details": "Drupal core 11.2 and above integrate the HTMX JavaScript library.\n\nDrupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.\n\nThe vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/core"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "11.3.0"
23+
},
24+
{
25+
"fixed": "11.3.14"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": ">=11.3.0 <11.3.14"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "11.4.0"
37+
},
38+
{
39+
"fixed": "11.4.4"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=11.4.0 <11.4.4"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.2.0"
51+
},
52+
{
53+
"fixed": "11.3.0"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": "11.2.*"
58+
}
59+
}
60+
],
61+
"database_specific": {
62+
"affected_versions": ">=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.*"
63+
}
64+
}
65+
],
66+
"references": [
67+
{
68+
"type": "WEB",
69+
"url": "https://www.drupal.org/sa-core-2026-011"
70+
}
71+
],
72+
"credits": [
73+
{
74+
"name": "Pierre Rudloff (prudloff)",
75+
"contact": [
76+
"https://www.drupal.org/u/prudloff"
77+
]
78+
}
79+
]
80+
}

‎advisories/core/DRUPAL-CORE-2026-012.json‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CORE-2026-012",
4+
"modified": "2026-07-15T19:52:26.000Z",
5+
"published": "2026-07-15T19:52:26.000Z",
6+
"aliases": [
7+
"CVE-2026-55805"
8+
],
9+
"details": "The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.\n\nThis is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/core"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "10.6.13"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<10.6.13"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "11.3.0"
37+
},
38+
{
39+
"fixed": "11.3.14"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=11.3.0 <11.3.14"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.4.0"
51+
},
52+
{
53+
"fixed": "11.4.4"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=11.4.0 <11.4.4"
58+
}
59+
},
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "11.0.0"
65+
},
66+
{
67+
"fixed": "11.1.0"
68+
}
69+
],
70+
"database_specific": {
71+
"constraint": "11.0.*"
72+
}
73+
},
74+
{
75+
"type": "ECOSYSTEM",
76+
"events": [
77+
{
78+
"introduced": "11.1.0"
79+
},
80+
{
81+
"fixed": "11.2.0"
82+
}
83+
],
84+
"database_specific": {
85+
"constraint": "11.1.*"
86+
}
87+
},
88+
{
89+
"type": "ECOSYSTEM",
90+
"events": [
91+
{
92+
"introduced": "11.2.0"
93+
},
94+
{
95+
"fixed": "11.3.0"
96+
}
97+
],
98+
"database_specific": {
99+
"constraint": "11.2.*"
100+
}
101+
}
102+
],
103+
"database_specific": {
104+
"affected_versions": "<10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*"
105+
}
106+
}
107+
],
108+
"references": [
109+
{
110+
"type": "WEB",
111+
"url": "https://www.drupal.org/sa-core-2026-012"
112+
}
113+
],
114+
"credits": [
115+
{
116+
"name": "haii haii (hai27ii2o)",
117+
"contact": [
118+
"https://www.drupal.org/u/hai27ii2o"
119+
]
120+
}
121+
]
122+
}

0 commit comments

Comments
 (0)