An improperly neutralized input during web page generation in Drupal core permits cross‑site scripting (XSS). This flaw allows an attacker to inject and execute arbitrary JavaScript in the context of a victim’s browser. Based on the description, the attack vector is inferred to be remote, reliant on the ability to submit content that is rendered without sufficient sanitization.

The vulnerability affects Drupal core from version 8.0.0 up to 10.3.13, from 10.4.0 up to 10.4.4, from 11.0.0 up to 11.0.12, and from 11.1.0 up to 11.1.4. It also impacts the Drupal 7 Link module versions 7.x-1.0 through 7.x-1.12.

The CVSS score of 5.4 indicates moderate severity, while an EPSS score below 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, the attack vector is inferred to be remote, allowing an attacker who can submit content rendered without sufficient sanitization to inject malicious scripts.