Drupal core contains a flaw in which user‑supplied data is rendered without proper escaping, creating a classic Cross‑Site Scripting vulnerability defined by CWE‑79. The defect enables an attacker to embed arbitrary HTML or JavaScript into content or URLs that the application subsequently serves to other users, resulting in client‑side code execution that can steal session cookies, hijack user sessions, deface content, or otherwise compromise the integrity and confidentiality of the site as viewed by visitors.

All Drupal core installations from version 0.0.0 up to any 11.3.12, inclusive, are impacted. This includes the 0.0.0-10.5.12 range, the 10.6.0-10.6.11 range, the 11.2.0-11.2.14 range, the 11.3.0-11.3.12 range, and every 11.0.x and 11.1.x release.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1 % shows that exploitation is currently considered rare. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be web‑based: an adversary can deliver crafted URLs or inject malicious content through forms that the site renders unescaped, allowing client‑side script execution without granting server‑side access or privilege escalation.