CVE-2026-55805
Project: Drupal core Date: 2026-July-15 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-55805 Description: The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface. Solution: Install the latest version: Drupal 11 If you use Drupal 11.4.x, update to Drupal 11.4.4 . If you use Drupal 11.3.x, update to Drupal 11.3.14 . Drupal 11.2.x and below are end-of-life and do not receive security coverage. Drupal 10 If you use Drupal 10.6.x, update to Drupal 10.6.13 . Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 and Drupal 9 have both reached end-of-life. Reported By: haii haii (hai27ii2o) Fixed By: danielveza Lee Rowlands (larowlan) of the Drupal Security Team Mingsong (mingsong) provisional member of the Drupal Security Team James Gilliland (neclimdul) of the Drupal Security Team Coordinated By: Greg Knaddison (greggles) of the Drupal Security Team Lee Rowlands (larowlan) of the Drupal Security Team Dave Long (longwave) of the Drupal Security Team Jess (xjm) of the Drupal Security Team
CSIRTS triage
- What
- The Layout Builder module doesn't sufficiently sanitize block labels, leading to a cross-site scripting (XSS) vulnerability.
- Who is affected
- Deployments of Drupal core versions listed above that use the Layout Builder editing interface are affected.
- Urgency
- Remediation is urgent due to the critical severity of the vulnerability, although exploitation requires specific conditions.
- Action
- Update to Drupal 11.4.4 for 11.4.x users, 11.3.14 for 11.3.x users, or upgrade to the latest version of Drupal 10.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-55805
Get an email if CVE-2026-55805 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (3)
- medium[NEW] [medium] Drupal Core: Multiple vulnerabilitiescert-bund · 2026-07-16
- unknownMultiple vulnerabilities in Drupal (July 16, 2026)cert-fr-avis · 2026-07-16
- criticalDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012drupal · 2026-07-15
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-55805)