🔐 CVE Alert

CVE-2026-58588

MEDIUM 6.1

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

CVSS Score
6.1
EPSS Score
0.2%
EPSS Percentile
10th

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

CWE CWE-79
Vendor drupal
Product drupal canvas
Ecosystems
Industries
WebMedia
Published Jul 10, 2026
Last Updated Jul 13, 2026
Stay Ahead of the Next One

Get instant alerts for drupal drupal canvas

Be the first to know when new medium vulnerabilities affecting drupal drupal canvas are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Drupal / Drupal Canvas
0.0.0 < 1.4.2 1.5.0 < 1.5.2 1.6.0 < 1.6.1 1.7.0 < 1.7.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
drupal.org: https://www.drupal.org/sa-contrib-2026-066

Credits

Christian López Espínola (penyaskito) AKHIL BABU (akhil babu) Christian López Espínola (penyaskito) Juraj Nemec (poker10)