The issue is a classic Cross‑Site Scripting (XSS) flaw caused by insufficient sanitization of user input during web page generation in Drupal Canvas. An attacker who can submit or influence content displayed by Drupal Canvas can inject malicious JavaScript that executes in the browsers of visitors to those pages. This client‑side execution can result in site defacement, theft of session cookies, or complete session hijacking for users who view the affected pages.

Drupal Canvas versions 0.0.0 through 1.4.2, 1.5.0 through 1.5.2, 1.6.0 through 1.6.1, and 1.7.0 through 1.7.1 are impacted; all other releases are outside the scope of this advisory.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% shows a low likelihood of exploitation at the time of this analysis and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is that an attacker must provide crafted input that a user subsequently views; no remote code execution or privilege escalation is possible solely from the flaw.