CVE-2026-6365
Project: Drupal core Date: 2026-April-15 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6365 Description: Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability. Solution: Install the latest version: If you use Drupal 10.5.x, update to Drupal 10.5.9 . If you use Drupal 10.6.x, update to Drupal 10.6.7 . If you use Drupal 11.2.x, update to Drupal 11.2.11 . If you use Drupal 11.3.x, update to Drupal 11.3.7 . Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. ( Drupal 8 and Drupal 9 have both reached end-of-life.) Reported By: Murat Kekiç (murat_kekic) Fixed By: Anna Kalata (akalata) of the Drupal Security Team Benji Fisher (benjifisher) of the Drupal Security Team Neil Drumm (drumm) of the Drupal Security Team Lee Rowlands (larowlan) of the Drupal Security Team Michael Hess (mlhess) of the Drupal Security Team James Gilliland (neclimdul) of the Drupal Security Team Joseph Zhao (pandaski) of the Drupal Security Team Juraj Nemec (poker10) of the Drupal Security Team Ra Mänd (ram4nd) , provisional member of the Drupal Security Team Jess (xjm) of the Drupal Security Team Coordinated By: Greg Knaddison (greggles) of the Drupal Security Team Lee Rowlands (larowlan) of the Drupal Security Team Pierre Rudloff (prudloff) of the Drupal Security Team Jess (xjm) of the Drupal Security Team
CSIRTS triage
- What
- Drupal core's jQuery integration for AJAX modal dialog boxes has a cross-site scripting (XSS) vulnerability.
- Who is affected
- Deployments of affected versions of Drupal core.
- Urgency
- Remediation is urgent due to the critical nature of the XSS vulnerability.
- Action
- Update to the latest version of Drupal core.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-6365
Get an email if CVE-2026-6365 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
Advisory coverage (1)
- criticalDrupal core - Critical - Cross-site scripting - SA-CORE-2026-001drupal · 2026-04-15
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-6365)