CVE-2026-58587
MEDIUM 6.1 ALL-YEARSImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
LIMITED SIGNALS
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 5th percentile
○ In CISA KEV○ Public exploit / PoC◆ SSVC: exploitation none, automatable no
Impact if exploited
6.1CVSS 3.1 · MEDIUM · ADP
- ConfidentialityLow
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.
Weakness (CWE)
- CWE-79: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Drupal Canvas Project | Drupal Canvas | < 1.4.2 |
| Drupal Canvas Project | Drupal Canvas | ≥ 1.5.0 and < 1.5.2 |
| Drupal Canvas Project | Drupal Canvas | ≥ 1.6.0 and < 1.6.1 |
| Drupal Canvas Project | Drupal Canvas | ≥ 1.7.0 and < 1.7.1 |
All CVSS metrics
- MEDIUM 6.1 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - MEDIUM 6.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N