[IT-SecNots] [Security-news] SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-140

Project: SafeDelete [1]
Date: 2026-September-09
Security risk: *Moderately critical* 12 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Cross-site scripting

Affected versions: <1.0.88
CVE IDs: CVE-2026-87942
Description: 
This module enables you to manage content deletion and provides reports for
identifying orphaned content.

The module doesn't sufficiently sanitize node titles when displaying the
orphaned nodes report. This leads to a persistent cross-site scripting
vulnerability (XSS).

This vulnerability is mitigated by the fact that an attacker must have
permission to create content of a content type configured for the orphaned
nodes report.

Solution: 
Install the latest version:

 * If you use the Safe Delete module, upgrade to Safe Delete 1.0.88 [3].

Reported By: 
 * Lee Rowlands (larowlan) [4] of the Drupal Security Team

Fixed By: 
 * Joseph Olstad (joseph.olstad) [5]
 * Lee Rowlands (larowlan) [6] of the Drupal Security Team
 * Scott Morrison (scottm316) [7]

Coordinated By: 
 * Bram Driesen (bramdriesen) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Lee Rowlands (larowlan) [10] of the Drupal Security Team
 * Jess  (xjm) [11] of the Drupal Security Team
 * Swan Kalata (akalata) [12] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [13]

[1] https://www.drupal.org/project/safedelete
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/safedelete/releases/1.0.88
[4] https://www.drupal.org/u/larowlan
[5] https://www.drupal.org/u/josepholstad
[6] https://www.drupal.org/u/larowlan
[7] https://www.drupal.org/u/scottm316
[8] https://www.drupal.org/u/bramdriesen
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/larowlan
[11] https://www.drupal.org/u/xjm
[12] https://www.drupal.org/u/akalata
[13]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3621890

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at