Drupal Fixes Two Critical Remote Code Execution Flaws and Three XSS Vulnerabilities

Security updates released on 14 October 2026 fix two Critical remote code execution vulnerabilities affecting Drupal core and the contributed Entity List module. The Drupal Security Team published five advisories covering the two code execution flaws and three cross-site scripting vulnerabilities in core and the Gin administration theme. Fixed versions are available for the supported Drupal 10 and Drupal 11 branches and the affected contributed projects.

The two Critical vulnerabilities have known exploitation paths involving interactions with other contributed modules, including paths that do not require authentication. Neither vulnerability is directly exploitable through its affected module alone, according to the advisories. Site administrators must therefore assess their installed components and apply the relevant fixes rather than rely on the absence of a directly exposed core vulnerability.

The most serious core disclosure, SA-CORE-2026-014 , concerns the Field UI module. Tracked as CVE-2026-108097, the remote code execution vulnerability is rated Critical, with a score of 19 out of 25 under Drupal's security risk assessment system. The Security Team says multiple serious exploit paths exist when contributed modules interact with the vulnerable functionality, and at least one known path requires no authentication.

Field UI provides an administrative interface for managing fields and their configuration. The advisory states that Drupal core alone does not expose a direct exploitation path, but contributed modules and custom code may make the vulnerable functionality accessible. Successful exploitation of a remote code execution vulnerability could allow an attacker to execute code on the affected server, with consequences depending on the available attack path and privileges.

The advisory identifies uninstalling the field_ui module as a temporary mitigation for sites unable to update immediately. Administrators considering this measure need to account for dependencies and administrative workflows that rely on Field UI. Installing the fixed core release remains the recommended response.

The Security Team also confirms that Drupal Steward provides protection against some known attack vectors associated with the Field UI vulnerability. However, the advisory explicitly states that this protection does not cover every possible exploit. Sites using Steward are therefore advised to update instead of treating the service as a complete substitute for the security release.

The second Critical advisory, SA-CONTRIB-2026-218 , affects the contributed Entity List module. The vulnerability is tracked as CVE-2026-108099 and carries the same Critical rating of 19 out of 25. Entity List enables developers to create lists of Drupal entities without relying on Views.

According to the advisory, the Entity List flaw cannot be exploited directly through the module alone. Multiple serious attack paths exist through interactions with other contributed modules, including at least one that does not require an authenticated user. Custom code may also expose the vulnerable functionality. The Security Team recommends upgrading affected installations to Entity List 3.0.10 .

The Entity List 3.0.10 release notes state that the fix mirrors changes made to Drupal core's Field UI module. This establishes a documented relationship between the repairs, although the published advisories do not establish that both vulnerabilities an identical underlying cause. Sites using Entity List must install its dedicated update because updating Drupal core does not independently replace the contributed module's vulnerable code.

Three additional advisories published during the same security window address cross-site scripting, or XSS, vulnerabilities. Such flaws can allow malicious scripts or markup to execute in another user's browser when the required conditions are met. Two affect Drupal core, while the third affects the contributed Gin administration theme.

The Link module advisory, SA-CORE-2026-015 , identifies insufficient sanitisation of certain markup. The module supplies a field type for internal and external URLs, and the flaw can lead to cross-site scripting in some circumstances. Tracked as CVE-2026-108515, the vulnerability is rated Moderately critical at 13 out of 25.

The second core XSS advisory, SA-CORE-2026-016 , concerns the module. The vulnerability results from insufficient sanitisation of certain attributes and is tracked as CVE-2026-108514. It is rated Moderately critical at 12 out of 25. The Security Team states that exploitation requires a role with permission to enter HTML tags containing specific data attributes or the administer permission.

The contributed Gin administration theme is affected by a separate XSS vulnerability disclosed through SA-CONTRIB-2026-219 . Gin provides an administrative interface for editors and site managers. The flaw, CVE-2026-110738, is rated Moderately critical at 13 out of 25 and involves insufficient sanitisation of certain attributes.

Exploitation of the Gin vulnerability requires a user role permitted to enter HTML tags containing specific data attributes or the administer permission. The affected versions include Gin releases earlier than 4.1.4 and versions from 5.0.0 up to, but not including, 5.0.16. Administrators using Gin 4.x should upgrade to Gin 4.1.4 , while those on Gin 5.x should install Gin 5.0.16 .

The three core vulnerabilities are fixed in Drupal 11.4.10, 11.3.19 and 10.6.19. Sites running Drupal 11.4.x should install 11.4.10 , while sites on Drupal 11.3.x should install 11.3.19 . Drupal 10.6.x installations should upgrade to 10.6.19 . Each release addresses the Field UI, Link and advisories.

The Security Team notes that Drupal 11.2.x and earlier Drupal 11 branches, as well as Drupal 10.5.x and earlier Drupal 10 branches, have reached end-of-life and no longer receive security coverage. Drupal 8 and Drupal 9 are also unsupported. Administrators running these versions need to move to a supported Drupal branch rather than expect patches for their existing release line.

The affected-version ranges for the three core advisories also include Drupal 12 prereleases. The Drupal 12.0.0-beta2 release, published on 14 October 2026, confirms fixes for all three core vulnerabilities. However, Drupal 12 remains in beta, and the project states that prereleases are intended for compatibility and upgrade testing rather than production use.

For administrators responding to the five disclosures, the immediate task is to identify the affected Drupal core branch and check whether Entity List or Gin is installed. The supported core updates address three advisories, but Entity List and Gin require their own security releases where present. Reviewing relevant permissions and custom integrations can help assess exposure, although the availability of patches means those checks should not delay updating.

The published advisories do not report confirmed exploitation of the vulnerabilities in the wild. They do, however, document potentially serious attack paths, including unauthenticated routes for both remote code execution flaws. The Security Team has supplied fixes for all five advisories, allowing administrators to address the disclosed risks through the relevant core and contributed-project updates.

Drupal core - Critical - Remote code execution - SA-CORE-2026-014 , Drupal Security Team (14 October 2026)

Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 , Drupal Security Team (14 October 2026)

Entity List 3.0.10 , Drupal.org (14 October 2026)

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 , Drupal Security Team (14 October 2026)

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 , Drupal Security Team (14 October 2026)

Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219 , Drupal Security Team (14 October 2026)

Gin 4.1.4 , Drupal.org (14 October 2026)

Gin 5.0.16 , Drupal.org (14 October 2026)

Disclosure: This content is produced with the assistance of AI.

Note: The vision of this web portal is to help promote news and stories around the Drupal community and promote and celebrate the people and organizations in the community. We strive to create and distribute our content based on these content policy . If you see any omission/variation on this please reach out to us at #thedroptimes channel on Drupal Slack and we will try to address the issue as best we can.