[IT-SecNots] [Security-news] Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-024

Project: Google Analytics GA4 [1]
Date: 2026-March-04
Security risk: *Moderately critical* 12 ∕ 25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross-site Scripting

Affected versions: <1.1.13
CVE IDs: CVE-2026-3529
Description: 
The Google Analytics GA4 module enables users to add custom attributes to the
script tag used to load the Google Analytics library. The module does not
sufficiently sanitize these attributes.

This vulnerability is mitigated by the fact that an attacker must have a role
with the "ga4 configure" (or "administer google analytics ga4 settings")
permission.

An attacker with this permission could inject malicious JavaScript via event
handlers (such as onload) or override the script source, leading to a
Cross-Site Scripting (XSS) attack on all pages where the GA4 script is
loaded.

Solution: 
Install the latest version:

 * If you use the Google Analytics GA4 module, upgrade to Google Analytics
   GA4 1.1.13 [3]

Reported By: 
 * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security
   Team

Fixed By: 
 * Sujan Shrestha (sujan shrestha) [5]

Coordinated By: 
 * Greg Knaddison (greggles) [6] of the Drupal Security Team
 * Juraj Nemec (poker10) [7] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [8]

[1] https://www.drupal.org/project/ga4_google_analytics
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ga4_google_analytics/releases/1.1.13
[4] https://www.drupal.org/u/prudloff
[5] https://www.drupal.org/u/sujan-shrestha
[6] https://www.drupal.org/u/greggles
[7] https://www.drupal.org/u/poker10
[8]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3577070

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at