CVE-2026-87942 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Safedelete

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-140

History

Thu, 22 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 22 Oct 2026 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal safedelete
Vendors & Products		Drupal Drupal safedelete

Thu, 22 Oct 2026 01:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.
Title		SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2026-140

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-22T01:22:00.354Z

Updated: 2026-10-22T17:19:38.323Z

Reserved: 2026-09-09T16:56:20.052Z

Link: CVE-2026-87942

Vulnrichment

Updated: 2026-10-22T17:19:31.654Z

NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:03.733

Modified: 2026-10-22T18:17:31.860

Link: CVE-2026-87942

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87942", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-09-09T16:56:20.052Z", "datePublished": "2026-10-22T01:22:00.354Z", "dateUpdated": "2026-10-22T17:19:38.323Z"}, "containers": {"cna": {"title": "SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140", "datePublic": "2026-09-09T17:19:26.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-140"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/safedelete", "product": "SafeDelete", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/safedelete", "versions": [{"lessThan": "1.0.88", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88."}], "credits": [{"lang": "en", "type": "finder", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Joseph Olstad (joseph.olstad)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Scott Morrison (scottm316)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:22:00.354Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T17:19:34.690732Z", "id": "CVE-2026-87942", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T17:19:38.323Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-87942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-22T17:19:34.690732Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T17:19:31.654Z"}}], "cna": {"title": "SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140", "credits": [{"lang": "en", "type": "finder", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Joseph Olstad (joseph.olstad)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Scott Morrison (scottm316)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/safedelete", "vendor": "Drupal", "product": "SafeDelete", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.0.88", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/safedelete"}], "datePublic": "2026-09-09T17:19:26.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-140"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:22:00.354Z"}}}, "cveMetadata": {"cveId": "CVE-2026-87942", "state": "PUBLISHED", "dateUpdated": "2026-10-22T17:19:38.323Z", "dateReserved": "2026-09-09T16:56:20.052Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-10-22T01:22:00.354Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}