Drupal Core Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Drupal Core versions 11.3.0 prior to 11.3.7. This issue arises from improper sanitization of input during web page generation, allowing malicious users to execute stored XSS attacks against other users.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to Drupal 11.3.7 to address this vulnerability. Instructions for updating can be found on the Drupal project page.