Advisory Catalog

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

rucio has an Authorization Bypass on REST API endpoint for signing URLs

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Highcharts Grid: `javascript:` URL in credits.href runs script on click

Highcharts Grid parses pagination language options as HTML

Highcharts Dashboards parses fullscreen labels as HTML

Highcharts Dashboards parses sidebar component labels as HTML

Highcharts: `javascript:` URL in credits.href runs script on click

Highcharts: dotted series.keys paths write to Object.prototype

Highcharts: series column construction writes to Object.prototype

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace

Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

This module allows for direct viewing of a file with the URL alias. This is a followup advisory to [SA-CONTRIB-2026-245](https://www.drupal.org/sa-contrib-2026-245), which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header `Cache-Control: pu

This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an attac

This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration to

The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author (user account or owner). As a result, a field

This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named `administrator` to bypass field-level access r

The module enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet

Stage File Proxy is a general solution for getting production files on a development server on demand. **It is not intended for usage on production sites.** The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scriptin

This module enables users to create and save signatures as SVG images. The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a

This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider. The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an at

This module provides a bulk form for assigning or removing roles on multiple user accounts at once. The bulk update form does not prevent access to users who do not have permission to assign roles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "a

S3 File System (s3fs) provides an additional file system to your Drupal site that stores files in Amazon's Simple Storage Service (S3) storage. The module doesn't sufficiently isolate upload context between separate object(file) operations in the same request resulting in the potential for objects

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user w

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle" pe

The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved. The module does not fully invalidate a solved CAPTCHA session. As a result, a pr

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on [becoming the maintainer of a project that is unsupported for security reaso

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on [becoming the maintainer of a project that is unsupported for security reaso

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on [becoming the maintainer of a project that is unsupported for security reaso

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attacke

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the w

The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields. The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.

This module provides a framework for integrating AI providers and features into Drupal. The module doesn't sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This module provides a framework for integrating AI providers and features into Drupal. Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the

This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector database for semantic search. The AI Search submodule has always been marked as 'experimental' but more importantly is deprecated. You may