CVE-2026-114534 drupal CVE debrief

Who should care

Drupal site administrators and security teams should assess exposure and apply patches. Site owners with untrusted users or content should prioritize verification and remediation. Defenders should verify exposure and apply patches for the block_attributes module, particularly for systems with untrusted users or content.

Why it matters

CVE-2026-114534 is a cross-site scripting vulnerability in the Drupal block_attributes module. Defenders should verify exposure, apply patches, and restrict 'administer blocks' permission to trusted users.

• Potential for attackers to inject malicious scripts on sites with vulnerable block_attributes module versions.
• Requires verification of exposure and patch application for systems with untrusted users or content.
• Mitigation is available in version 2.1.0 or later of the block_attributes module.

Technical summary

The Drupal block_attributes module allows custom attributes for blocks but does not sufficiently sanitize them against cross-site scripting. An attacker with 'administer blocks' permission could inject malicious scripts. The issue is mitigated by the fact that the attacker must have the `administer blocks` permission. Defenders should prioritize verifying exposure and applying patches for the block_attributes module, particularly for systems with untrusted users or content. The vulnerability is confirmed in versions <2.1.0 of the block_attributes module.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for the block_attributes module, particularly for systems with untrusted users or content.

Recommended defensive actions

• Verify the version of the block_attributes module and update to 2.1.0 or later if possible.
• Restrict 'administer blocks' permission to trusted users.
• Monitor for suspicious block attribute changes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in versions <2.1.0 of the block_attributes module. Official sources include the CVE Program, NVD, and Drupal's security advisory. The issue allows attackers with 'administer blocks' permission to inject malicious scripts. Defenders should verify exposure and apply patches for the block_attributes module, particularly for systems with untrusted users or content.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.