This vulnerability is an Improper Neutralization of Input During Web Page Generation (CWE‑79) that allows an attacker to inject arbitrary scripts into pages served by Drupal core. The injected script can steal user credentials, hijack sessions, or perform other malicious actions, leading to loss of confidentiality and integrity for unsuspecting end‑users and site owners.

The flaw affects all supported Drupal core versions up to and including 8.x, 10.x, and 11.x. Specifically, any release before 10.5.9, before 10.6.7, before 11.2.11, or before 11.3.7 is vulnerable.

The vulnerability has an EPSS score of < 1%, indicating a very low but non‑zero exploitation probability, and a CVSS score of 6.1 (medium severity). It is not listed in CISA KEV, but its severity stems from its ability to inject arbitrary scripts into pages served by Drupal core. Attackers can exploit it by crafting malicious input that is rendered unescaped in Drupal pages; no special conditions beyond standard web interaction are required.