As cited
Copy frozen at (site build).
vulnerabilities
NCSC-2026-0438 Vulnerabilities patched in Drupal Core and modules by Drupal
Drupal released security patches for multiple components including Field UI, Entity List, Navigation, Link modules, and the Gin administration theme. The vulnerabilities include remote code execution flaws in Field UI and Entity List modules, which can be exploited through contributed modules or custom code with some attack paths requiring no authentication, and cross-site scripting (XSS) flaws in Navigation, Link, and Gin that stem from insufficient sanitization of HTML or URL attributes. XSS exploitation requires users with specific permissions, and most remote code execution paths depend on vulnerable plugins or external modules.
Why it matters: Drupal administrators using these modules or themes must apply patches immediately to prevent unauthorized code execution; those without specific contributed modules may face lower risk, but should review their installed plugins and external modules.
- Source published
- First seen by Cybersecurity Tracker