CVE-2026-107308 drupal CVE debrief

Who should care

Drupal users and administrators who have installed the Country module, especially those using additional modules or custom code that could trigger the vulnerability, should assess their exposure and prioritize updating the module.

Why it matters

CVE-2026-107308 is a cross-site scripting vulnerability in the Drupal Country module's autocomplete widget. Defenders should verify and update the module, review additional modules and custom code, and monitor for suspicious activity.

• Verify and update the Country module to prevent potential cross-site scripting
• Review and monitor additional modules and custom code for exploitation triggers
• Assess exposure and prioritize updates for affected versions

Technical summary

The Drupal Country module's autocomplete widget does not sufficiently escape user input, leading to a cross-site scripting vulnerability. This issue requires additional modules or custom code to occur and affects versions before 2.1.3 and 2.2.0 to 2.2.1. The vulnerability is confirmed in the Country module versions before 2.1.3 and 2.2.0 to 2.2.1. Official source details are limited, and further verification is required to understand the full scope of affected versions and potential exploits. Defenders should prioritize verifying and updating the Country module to the latest version, especially if additional modules or custom code is used that could trigger the vulnerability.

Defensive priority

Defenders should prioritize verifying and updating the Country module to the latest version, especially if additional modules or custom code is used that could trigger the vulnerability.

Recommended defensive actions

• Verify and update the Country module to the latest version
• Review additional modules and custom code for potential exploitation triggers
• Monitor for suspicious activity related to the Country module's autocomplete widget
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in the Country module versions before 2.1.3 and 2.2.0 to 2.2.1. Official source details are limited, and further verification is required to understand the full scope of affected versions and potential exploits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.