This vulnerability is an improper neutralization of input during web page generation that allows a stored cross‑site scripting (XSS) attack in Drupal Black Hole. By injecting malicious script into content that is later rendered by the site, an attacker can cause arbitrary code to run in the browsers of users who view the affected pages. This could lead to session hijacking, defacement, or the execution of further malicious payloads in the victim’s context.

The affected product is Drupal Black Hole. Versions from 0.0.0 through 1.26.0, and from 2.0.0 through 2.0.1, are vulnerable. Any installation running a version outside these ranges is not affected, but without an upgrade the site remains susceptible.

The CVSS score is not supplied in the CVE record; however the nature of a stored XSS suggests a high impact, eligible for a high or critical risk rating. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by submitting malicious content through the site's content input mechanisms, which will be stored and subsequently rendered for all visitors, implying a direct attack vector that does not require authentication if there is a publicly writable input path.