Skip to content

Commit 0e528e1

Browse files
DrupalSecurityBotgithub-actions[bot]
DrupalSecurityBot
and
github-actions[bot]
authored
feat: update advisories (#182)
🤖 beep boop - looks like there's some changes to the advisories! Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 32d1cd1 commit 0e528e1

10 files changed

Lines changed: 508 additions & 2 deletions

File tree

‎advisories/canvas/DRUPAL-CONTRIB-2026-017.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-017",
4+
"modified": "2026-02-25T18:51:01.000Z",
5+
"published": "2026-02-25T18:51:01.000Z",
6+
"aliases": [
7+
"CVE-2026-3216"
8+
],
9+
"details": "This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers.\n\nThe project has a hidden sub-module, **Drupal Canvas AI**, which is disabled by default. It is typically enabled as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush). When the submodule is enabled, the following vulnerability is exposed.\n\nThe module doesn't sufficiently sanitize user-supplied data via crafted API requests within the messages JSON payload.\n\nIt is mitigated by the fact that an attacker must have a role with the permission \"use Drupal Canvas AI\".\n\n**How the Canvas AI sub-module gets enabled:** As a hidden submodule, `canvas_ai` is not intended for manual activation via the UI. It is designed to be pulled in as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush).",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/canvas"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.1.1"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.1.1"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<1.1.1"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-017"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Drew Webber (mcdruid)",
47+
"contact": [
48+
"https://www.drupal.org/u/mcdruid"
49+
]
50+
}
51+
]
52+
}

‎advisories/captcha/DRUPAL-CONTRIB-2026-015.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-015",
4+
"modified": "2026-02-25T18:47:57.000Z",
5+
"published": "2026-02-25T18:47:57.000Z",
6+
"aliases": [
7+
"CVE-2026-3214"
8+
],
9+
"details": "This module enables you to protect web forms from automated spam by requiring users to pass a challenge.\n\nThe module doesn't sufficiently invalidate used security tokens under certain scenarios, which can lead to the CAPTCHA being bypassed on subsequent submissions.\n\nThis vulnerability is mitigated by the fact that an attacker must first successfully solve at least one CAPTCHA manually to harvest the valid tokens.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/captcha"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.17.0"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.17.0"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "2.0.0"
37+
},
38+
{
39+
"fixed": "2.0.10"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=2.0.0 < 2.0.10"
44+
}
45+
}
46+
],
47+
"database_specific": {
48+
"affected_versions": "<1.17.0 || >=2.0.0 < 2.0.10"
49+
}
50+
}
51+
],
52+
"references": [
53+
{
54+
"type": "WEB",
55+
"url": "https://www.drupal.org/sa-contrib-2026-015"
56+
}
57+
],
58+
"credits": [
59+
{
60+
"name": "Andrew Belcher (andrewbelcher)",
61+
"contact": [
62+
"https://www.drupal.org/u/andrewbelcher"
63+
]
64+
},
65+
{
66+
"name": "Chris Dudley (dudleyc)",
67+
"contact": [
68+
"https://www.drupal.org/u/dudleyc"
69+
]
70+
},
71+
{
72+
"name": "Tim Wood (timwood)",
73+
"contact": [
74+
"https://www.drupal.org/u/timwood"
75+
]
76+
},
77+
{
78+
"name": "tamasd",
79+
"contact": [
80+
"https://www.drupal.org/u/tamasd"
81+
]
82+
}
83+
]
84+
}

‎advisories/cleantalk/DRUPAL-CONTRIB-2026-014.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-014",
4+
"modified": "2026-02-25T18:46:10.000Z",
5+
"published": "2026-02-25T18:46:10.000Z",
6+
"aliases": [
7+
"CVE-2026-3213"
8+
],
9+
"details": "This module enables you to block bots by Firewall.\n\nThe module doesn't sufficiently sanitize user input leading to a reflected Cross-site scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that the vulnerable functionality is only presented to users that are \"challenged\" or blocked by the firewall.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/cleantalk"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "9.7.0"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<9.7.0"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<9.7.0"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-014"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Drew Webber (mcdruid)",
47+
"contact": [
48+
"https://www.drupal.org/u/mcdruid"
49+
]
50+
}
51+
]
52+
}

‎advisories/islandora/DRUPAL-CONTRIB-2026-016.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-016",
4+
"modified": "2026-02-25T18:49:59.000Z",
5+
"published": "2026-02-25T18:49:59.000Z",
6+
"aliases": [
7+
"CVE-2026-3215"
8+
],
9+
"details": "This module integrates with Islandora, an open-source digital asset management (DAM) framework. Islandora integrates with various open-source services, which can be run in a distributed environment.\n\nThe module doesn't sufficiently sanitize URI paths for its custom route used for attaching media to nodes, which can also lead to cross-site scripting and other vulnerabilities.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"create media\" and the ability to edit the node the media is being attached to.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/islandora"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.17.5"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.17.5"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.17.5"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-016"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Drew Webber (mcdruid)",
47+
"contact": [
48+
"https://www.drupal.org/u/mcdruid"
49+
]
50+
}
51+
]
52+
}

‎advisories/material_icons/DRUPAL-CONTRIB-2026-011.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-011",
4+
"modified": "2026-02-25T18:43:32.000Z",
5+
"published": "2026-02-25T18:43:32.000Z",
6+
"aliases": [
7+
"CVE-2026-3210"
8+
],
9+
"details": "This module enables you to add icons to CKEditor.\n\nThe module doesn't sufficiently add custom permissions to the dialog and autocomplete routes, allowing full access to the routes in most scenarios.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/material_icons"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.0.4"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.0.4"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.0.4"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-011"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Jen M (jannakha)",
47+
"contact": [
48+
"https://www.drupal.org/u/jannakha"
49+
]
50+
}
51+
]
52+
}

‎advisories/miniorange_saml/DRUPAL-CONTRIB-2026-018.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-018",
4+
"modified": "2026-02-25T18:51:26.000Z",
5+
"published": "2026-02-25T18:51:26.000Z",
6+
"aliases": [
7+
"CVE-2026-3217"
8+
],
9+
"details": "This module enables you to perform SAML protocol-based single sign-on (SSO) on a Drupal site.\n\nThe module doesn't sufficiently sanitize user input, leading to a reflected Cross-site scripting (XSS) vulnerability.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/miniorange_saml"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "3.1.3"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<3.1.3"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<3.1.3"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-018"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Drew Webber (mcdruid)",
47+
"contact": [
48+
"https://www.drupal.org/u/mcdruid"
49+
]
50+
}
51+
]
52+
}

0 commit comments

Comments
 (0)