The vulnerability is an improper neutralization of input during web page generation that permits stored cross‑site scripting. A malicious user can inject arbitrary JavaScript into a menu link attribute; the payload is stored by the catalog and rendered when the page is loaded, enabling session hijacking, redirection, or stealth content injection, thereby compromising confidentiality and integrity.

The Drupal Menu Link Attributes module in versions 0.0.0 through 1.8.0 is affected. Any site using these releases of the module is vulnerable regardless of the Drupal core version.

No EPSS score is currently published, and the flaw is not listed in the CISA KEV catalog. Because it is stored XSS, the CVSS score would be high; the attack vector is easy: an attacker only needs to supply injected content when creating or editing a menu link, after which the payload executes in the browsers of all users who view the page.