Drupal core contains an Improper Neutralization of Input During Web Page Generation flaw that can lead to Cross‑Site Scripting (XSS). An attacker may be able to inject malicious JavaScript into pages that are displayed to users, potentially enabling data theft, defacement, phishing, or session hijacking. The weakness is classified as CWE‑79 and arises from insufficient input sanitization in content rendering.

Drupal core is affected across several major release streams. In particular, all versions from 8.9.0 to 10.6.19, 11.0.0 to 11.3.19, 11.4.0 to 11.4.10, and 12.0.0‑alpha1 to 12.0.0‑beta2 are vulnerable unless the official security patch has been applied.

The CVSS score is not listed in the CVE record, and the EPSS score is unavailable, so the precise quantitative severity cannot be determined from this data alone. However, XSS vulnerabilities typically carry significant risk of compromising confidentiality, integrity, or availability of users interacting with the affected web pages. Based on the description, it is inferred that the flaw may be exploitable by submitting malicious input through any user‑editable content field that is rendered without proper sanitization; the advisory does not state whether authentication or elevated privileges are required, so the extent of required access is unclear. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that no widespread exploitation has been reported to date, but the lack of an EPSS score means that future exploitation risk could still evolve.