Security advisories

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

The Drupal core Link module provides a field type that can be used for internal and external URLs.

The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.

Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators.

The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes or the administer menu permission.

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem.

The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

The vulnerability is mitigated by the fact that advanced_filesystem_backup module must be enabled.

This module enables you to restrict view access to single nodes via taxonomy terms.

The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API.

This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present.

This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content.

The module doesn’t sufficiently prevent page titles being viewed for certain privately-accessible URLs.

This vulnerability is mitigated by the fact that an attacker must have access to use a text format with the Freelinking plugin configured to allow privately-accessible external URLs to be crawled. Site administrators may want to disable this functionality to evaluate any risk.

This module enables you to show a breadcrumb trail for taxonomy term hierarchies.

The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment.

This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" (term_hierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished.

The module Country provides a dedicated field type for Drupal core's official country list.

The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability.

This vulnerability is mitigated by the fact that it can not occur out of the box with the Country module, additional module(s) or custom code is required.

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to.

The module's search query did not respect entity access when returning results to the browser.

This vulnerability is mitigated by the fact that an user must have permission to use the AI CKEditor "Generate internal links" feature on a text format.

This module enables you to add HTML attributes to menu links and their container elements (<li>).

The module doesn't sufficiently sanitize the attributes it applies to menu link container elements.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "Administer menus and menu links" and "Use menu link attributes". In addition, an unsafe container attribute must already be configured by a user with the restricted permission "Administer menu link attributes". The default configuration is not affected.

The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API.

The module does not correctly check access for all of its endpoints, leading to a potential access bypass.

The vulnerability is mitigated by the fact that it is only impactful for sites that do not give "access content" permission to the anonymous role.

This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration.

The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content.

This vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user's email or password hash) are not disclosed.

This module enables you to "share" a view display within another website via an iframe.

The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance.

This vulnerability is mitigated by the fact that an attacker must know the view and display IDs.

The Leaflet module provides integration with the Leaflet JS mapping library.

Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability.

This vulnerability is mitigated by the fact an attacker needs to have permission to create or edit content that is used in a Leaflet map.

The Inline Formatter Field module allows site builders to template and style entities with a field.

This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands.

This module provides a new UI experience for node editing using the Gutenberg Editor library.

The module does not sufficiently check entity access in several editor endpoints.

This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission.

This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide.

The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.

This module enables you to link the output of a field to a URL or to the value of another field.

The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site configuration values, which may include sensitive information such as API keys or credentials.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content in a field that has Linked Field enabled in its display settings.

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields.

This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages".