Skip to content

Commit e511096

Browse files
DrupalSecurityBotgithub-actions[bot]
DrupalSecurityBot
and
github-actions[bot]
authored
feat: update advisories (#213)
🤖 beep boop - looks like there's some changes to the advisories! - https://www.drupal.org/SA-CONTRIB-2026-036 - https://www.drupal.org/SA-CONTRIB-2026-037 - https://www.drupal.org/SA-CONTRIB-2026-035 - https://www.drupal.org/SA-CONTRIB-2026-034 Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent a7afdc0 commit e511096

4 files changed

Lines changed: 222 additions & 0 deletions

File tree

‎advisories/colorbox_inline/DRUPAL-CONTRIB-2026-036.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-036",
4+
"modified": "2026-05-13T17:18:29.000Z",
5+
"published": "2026-05-13T17:18:29.000Z",
6+
"aliases": [
7+
"CVE-2026-8493"
8+
],
9+
"details": "This module enables you to open content already on the page within a colorbox.\n\nThe module doesn't sufficiently sanitize the data-colorbox-inline attribute value before passing it to jQuery, leading to a Cross-Site Scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/colorbox_inline"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.1.1"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.1.1"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.1.1"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-036"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Pierre Rudloff (prudloff)",
47+
"contact": [
48+
"https://www.drupal.org/u/prudloff"
49+
]
50+
}
51+
]
52+
}

‎advisories/date_ical/DRUPAL-CONTRIB-2026-037.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-037",
4+
"modified": "2026-05-13T17:19:25.000Z",
5+
"published": "2026-05-13T17:19:25.000Z",
6+
"aliases": [
7+
"CVE-2026-8495"
8+
],
9+
"details": "This module enables you to export entity date fields as iCal feeds.\n\nThe module doesn't sufficiently check entity or field access or sanitize user inputs when generating iCal feeds.\n\nThis vulnerability is not mitigated by any permission, the routes are accessible to all anonymous users with no configuration required.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/date_ical"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "4.0.15"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<4.0.15"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<4.0.15"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-037"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Drew Webber (mcdruid)",
47+
"contact": [
48+
"https://www.drupal.org/u/mcdruid"
49+
]
50+
}
51+
]
52+
}

‎advisories/gtranslate/DRUPAL-CONTRIB-2026-035.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-035",
4+
"modified": "2026-05-13T17:17:42.000Z",
5+
"published": "2026-05-13T17:17:42.000Z",
6+
"aliases": [
7+
"CVE-2026-8492"
8+
],
9+
"details": "The GTranslate module provides a language switcher widget for Drupal sites.\n\nThe module\u2019s widget JavaScript did not sufficiently validate that document.currentScript referred to the executing script element. A user who can add HTML to a page could cause the generated language-switcher links to point to an unintended domain.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to add HTML with attributes that are not allowed by Drupal\u2019s default CKEditor configuration. It is also limited to sites using the paid versions of GTranslate widget JavaScript and configurations where the generated language links use script-provided values.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/gtranslate"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "3.0.5"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<3.0.5"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<3.0.5"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-035"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Pierre Rudloff (prudloff)",
47+
"contact": [
48+
"https://www.drupal.org/u/prudloff"
49+
]
50+
}
51+
]
52+
}

‎advisories/node_view_permissions/DRUPAL-CONTRIB-2026-034.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-034",
4+
"modified": "2026-05-13T18:16:36.000Z",
5+
"published": "2026-05-13T17:16:59.000Z",
6+
"aliases": [
7+
"CVE-2026-8491"
8+
],
9+
"details": "Node view permissions module enables permissions \"View own content\" and \"View any content\" for each content type on permissions page \nThe module doesn't sufficiently handle the case where a user is cancelled and their content is reassigned to the anonymous user. \nThis vulnerability is mitigated by the fact that only private contents where anonymous should not have view access are affected, and only if a node was reassigned to the anonymous user.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/node_view_permissions"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.7.0"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.7.0"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "2.0.0"
37+
},
38+
{
39+
"fixed": "2.0.1"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=2.0.0 <2.0.1"
44+
}
45+
}
46+
],
47+
"database_specific": {
48+
"affected_versions": "<1.7.0 || >=2.0.0 <2.0.1"
49+
}
50+
}
51+
],
52+
"references": [
53+
{
54+
"type": "WEB",
55+
"url": "https://www.drupal.org/sa-contrib-2026-034"
56+
}
57+
],
58+
"credits": [
59+
{
60+
"name": "Adam Shepherd (adamps)",
61+
"contact": [
62+
"https://www.drupal.org/u/adamps"
63+
]
64+
}
65+
]
66+
}

0 commit comments

Comments
 (0)