CVE-2026-0946

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.

PUBLISHED Reserved 2026-01-14 | Published 2026-02-04 | Updated 2026-02-06 | Assigner drupal

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Product status

Credits

Pierre Rudloff (prudloff) finder

Frank Mably (mably) remediation developer

Greg Knaddison (greggles) coordinator

Juraj Nemec (poker10) coordinator

References

www.drupal.org/sa-contrib-2026-003

cve.org (CVE-2026-0946)

nvd.nist.gov (CVE-2026-0946)

Download JSON