Drupal Contrib Security

Project: WissKIDate: 2026-June-24Security risk: Critical 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <4.2.0CVE IDs: CVE-2026-13239Description: 

The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer.

It does not sufficiently check the submitted parameters via a route and writes these to the session object without further checks, which can lead to Access Bypass.

This vulnerability is mitigated by the fact that it is specific to the wisski_mirador submodule.

Solution: 

Install the latest version:

• If you use the WissKI module version 8.x-4.1, upgrade to WissKI 8.x-4.2

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• knurg

Coordinated By: 

• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Commerce Realex / Global PaymentsDate: 2026-June-24Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Access BypassAffected versions: <3.0.2CVE IDs: CVE-2026-13238Description: 

This module enables you to take payments through the Global Payments / Realex Hosted Payment Page (HPP), either via a lightbox iframe or via a full-page redirect.

When the gateway is configured with the redirect payment method, the module doesn't sufficiently verify the authenticity of the payment response returned by Global Payments.

The lightbox payment method validates the signature and is not affected, so sites that use the lightbox payment method are not affected.

Solution: 

Install the latest version:

• If you use the commerce_realex module <=3.0.1, upgrade to commerce_realex 3.0.2.

The redirect payment response is now cryptographically verified against the merchant shared secret .

Sites that cannot update immediately should disable this payment gateway, until the update can be applied.

Reported By: 

• Bill Seremetis (bserem)

Fixed By: 

• Alan Burke (alanburke)
• Bill Seremetis (bserem)
• Jaime Seuma (jaims-dev)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI AgentsDate: 2026-June-24Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Information disclosure, Access bypassAffected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1CVE IDs: CVE-2026-13237Description: 

This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools.

Under certain circumstances, the agent inherits deterministic parameters when invoking the same tool in one request, which can lead to information disclosure.

Solution: 

Install the latest version:

• If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4
• If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5
• If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1

Reported By: 

• Andrew Belcher (andrewbelcher)
• Rob Edwards (rob_e)

Fixed By: 

• Andrew Belcher (andrewbelcher)
• Marcus Johansson (marcus_johansson)
• Rob Edwards (rob_e)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI AgentsDate: 2026-June-24Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1CVE IDs: CVE-2026-13236Description: 

This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools.

The module does not sufficiently check the required permissions when a tool loads content entities.

This vulnerability is mitigated by the fact that an agent must be configured to use the affected tool, and an attacker must have access to that agent.

Solution: 

Install the latest version:

• If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4
• If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5
• If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1

Reported By: 

• Kuniyoshi Noguchi (kuninogu)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• AKHIL BABU (akhil babu)
• harivansh sharma (harivansh)
• Kuniyoshi Noguchi (kuninogu)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team

Project: AI (Artificial Intelligence)Date: 2026-June-24Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3CVE IDs: CVE-2026-13235Description: 

This module enables you to utilize an agent to use Drupal core actions tools with bypassed access.

Certain Drupal core actions, exposed as agent tools did not have correct access validation, and some core actions were missing associated access-level definitions.

This vulnerability is mitigated by the fact that an attacker must have access to communicate with an affected agent, the site must be configured to expose the affected tools to non-privileged users.

Solution: 

Install the latest version:

• If you use the AI module 1.2.16, upgrade to AI 1.2.17
• If you use the AI module 1.3.7 upgrade to AI 1.3.8
• If you use the AI module 1.4.2 upgrade to AI 1.4.3

Reported By: 

• AKHIL BABU (akhil babu)
• Kuniyoshi Noguchi (kuninogu)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Marcus Johansson (marcus_johansson)
• Dezső Biczó (mxr576)
• Valery Lourie (valthebald)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI (Artificial Intelligence)Date: 2026-June-24Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Information Disclosure / Cross-site ScriptingAffected versions: <1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3CVE IDs: CVE-2026-13234Description: 

The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser.

Under certain circumstances, rendering of this HTML can lead to Cross Site Scripting, or exposing secret communications in the context of the LLM request.

This vulnerability is mitigated by the fact that an attacker must be able to inject text into prompts to create an attack.

Solution: 

Install the latest version:

• If you use the AI module 1.2.16, upgrade to AI 1.2.17
• If you use the AI module 1.3.7 upgrade to AI 1.3.8
• If you use the AI module 1.4.2 upgrade to AI 1.4.3

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Abhisek Mazumdar (abhisekmazumdar)
• AKHIL BABU (akhil babu)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: OpenAI ProviderDate: 2026-June-24Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Server-side Request ForgeryAffected versions: <1.1.1 || >=1.2.0 <1.2.2CVE IDs: CVE-2026-13233Description: 

This module enables you to use OpenAI as a provider for the AI module.

The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have the access to change the host url and a way to generate AI-generated images.

Solution: 

Install the latest version:

• If you use the OpenAI Provider module 1.1.0, upgrade to OpenAI Provider 1.1.1
• If you use the OpenAI module 1.2.1 upgrade to OpenAI Provider 1.2.2

Reported By: 

• Kuniyoshi Noguchi (kuninogu)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Kuniyoshi Noguchi (kuninogu)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: Advanced Content Feedback (aka admin_feedback)Date: 2026-June-24Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypass / Insecure Direct Object Reference (IDOR)Affected versions: <2.8.0CVE IDs: CVE-2026-13232Description: 

This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote.

The module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "give feedback". Note: "give feedback" is granted to anonymous and authenticated by default on install.

Solution: 

Install the latest release:

• If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8

The comment endpoint now requires an HMAC-signed token bound to the specific feedback row (issued only to the visitor who cast that vote), and a comment may be written only once, preventing both forgery of arbitrary ids and replay.

Reported By: 

• Bill Seremetis (bserem)

Fixed By: 

• Bill Seremetis (bserem)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team

Project: Advanced Content Feedback (aka admin_feedback)Date: 2026-June-24Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <2.8.0CVE IDs: CVE-2026-13231Description: 

This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses.

The module doesn't sufficiently sanitize several administrator-configured response messages (the "Yes response", "No response", and the custom text shown on a "No" answer) under the scenario where those settings contain HTML or script markup, which is then emitted as raw HTML in the feedback response shown to visitors.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer admin feedback".

Solution: 

Install the latest release:

• If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8

The configured plain-text responses are now escaped with `Html::escape()`, and the formatted "No" response is rendered through its configured text format filter (`check_markup()`) instead of being printed raw.

Reported By: 

• Bill Seremetis (bserem)

Fixed By: 

• Bill Seremetis (bserem)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Plotly.js GraphingDate: 2026-June-17Security risk: Critical 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: <3.0.2CVE IDs: CVE-2026-55810Description: 

The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library.

The module stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when the data are unserialized.

This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached plotly_js_graph field. In addition, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly.

Solution: 

Install the latest version:

• If you use the Plotly.js Graphing module for Drupal, upgrade to plotly_js-3.0.2.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Stephen Mustgrave (smustgrave)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Flag attendance fieldDate: 2026-June-17Security risk: Critical 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: <1.2CVE IDs: CVE-2026-55809Description: 

The Flag attendance field module gives you the ability to add attendance by depending on Flag module.

flag_attendance_field stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when the data are unserialized.

This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached flag_attendance_field field. In addition, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly.

Solution: 

Install the latest version:

• If you use the Flag attendance field module for Drupal, upgrade to Flag attendance field 8.x-1.2.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Anas Mawlawi (anas_maw)
• Benji Fisher (benjifisher) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team

Coordinated By: 

• Benji Fisher (benjifisher) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Formatter FieldDate: 2026-June-17Security risk: Critical 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: <2.0.0CVE IDs: CVE-2026-12535Description: 

The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis.

formatter_field stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an Object Injection vulnerability when the data are unserialized.

This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached formatter_field field. In addition, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly.

Solution: 

Install the latest version:

• If you use the Formatter Field module, upgrade to Formatter Field 2.0.0.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Kostia Bohach (_shy)

Coordinated By: 

• Benji Fisher (benjifisher) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Brute force attack protectionDate: 2026-June-10Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-11915Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: ComposerDate: 2026-June-10Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-11914Description: 

The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Note: this is about a project for the Drupal system that makes use of composer. It is not a vulnerability in the composer software itself.

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: Mother May IDate: 2026-June-10Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-11913Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: Examples for DevelopersDate: 2026-June-10Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <4.0.6CVE IDs: CVE-2026-11909Description: 

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality.

The "Read from a file" feature implemented by the file_example submodule can be used to expose any file that PHP can access. Therefore, the file_example sub-module is being removed from Examples for Developers until a version demonstrating file security best practices can be added back in the future. Developers who based a new module on this example should review their code for an access bypass.

Solution: 

Any site with the file_example submodule installed should uninstall it immediately. Then, install the latest version of Examples for Developers:

• If you are using Examples for Developers 4.0.x, upgrade to Examples for Developers 4.0.6. Developers who based a new module on this example should review their code for an access bypass.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Alberto Paderno (avpaderno)
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: TagifyDate: 2026-June-10Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scripting (XSS)Affected versions: <1.2.52CVE IDs: CVE-2026-11908Description: 

This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets.

The module does not properly sanitise the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the user’s session.

The vulnerability is mitigated by the fact an attacker must have a role with permission to create or edit taxonomy terms in a vocabulary.

Solution: 

Install the latest version of the Tagify module that includes a fix for sanitising parent term names in the Tagify dropdown rendering.

• If you use the Tagify module for Drupal, upgrade to tagify 1.2.52.

More information will be provided in the project release notes once the fixed version is published.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• David Galeano (gxleano)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Anti-Spam by CleanTalkDate: 2026-June-03Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross site scriptingAffected versions: <9.7.1CVE IDs: CVE-2026-10770Description: 

This module provides spam protection using the CleanTalk cloud service.

The module doesn't sufficiently sanitize API response messages before rendering them in HTML output. The _cleantalk_die() and ct_die() functions output the CleanTalk API response message directly into HTML without proper sanitization, allowing potential injection of arbitrary HTML or JavaScript.

This vulnerability is mitigated by the fact that an attacker must be able to influence the CleanTalk cloud API response (e.g., through a man-in-the-middle attack or a compromised API server).

Solution: 

Install the latest version:

• If you use the Anti-Spam by CleanTalk module for Drupal upgrade to Anti-Spam by CleanTalk 9.7.1

Reported By: 

• Ra Mänd (ram4nd) provisional member of the Drupal Security Team

Fixed By: 

• alexandergull
• anton1211
• Ra Mänd (ram4nd) provisional member of the Drupal Security Team

Coordinated By: 

• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Commerce CoreDate: 2026-June-03Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross site scriptingAffected versions: >= 3.3.0 < 3.3.6CVE IDs: CVE-2026-10769Description: 

The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting (XSS).

This vulnerability is mitigated by the fact that it only affects installations with Checkout (commerce_checkout) enabled, and the "Comments" checkout pane (id: customer_comments) is explicitly used, which is disabled by default.

Solution: 

Install the latest version:

• If you use Commerce Core 3.3.x, upgrade to Commerce Core 3.3.6

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Jonathan Sacksick (jsacksick)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: TacJSDate: 2026-June-03Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Improper Access ControlAffected versions: <6.8CVE IDs:  CVE-2026-49977 Description: 

This module enables sites to comply with the European cookie law using tarteaucitron.js.

The module doesn't sufficiently filter user-supplied markup inside of content leading to an attacker being able to delete arbitrary cookies.

This vulnerability is mitigated by the fact that an attacker needs to be able to insert specific data attributes in the page.

For additional information, see the Github Security Advisory GHSA-jxj7-g6gm-49j7 for the tarteaucitron.js library.

Solution: 

Install the latest version:

• If you use tacjs 8.x-6.x, upgrade to tacjs 8.x-6.8

Reported By: 

• Frank Mably (mably)
• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team