Drupal’s Link content parser is vulnerable to input that contains malicious link syntax. The flaw allows an attacker to insert arbitrary payloads into the parser’s output, which can then be delivered to a browser as part of rendered content. This may result in client-side attacks such as cross-site scripting, defacement, or information disclosure. The weakness is a classic injection flaw that directly reflects attacker-supplied data into rendered output.

All Drupal sites that include the Link content parser component are potentially impacted. The product is the Drupal Link content parser, and the affected version designation is *.*, meaning any current installation of the parser without an update is at risk. Administrators should verify whether their site’s parser version is the default one shipped with Drupal or a custom package and determine if it has been patched by a newer release.

The CVSS score is 5.9, and the EPSS score is unavailable, so the precise exploitation likelihood cannot be quantified. The issue is not in the CISA KEV catalog, but its critical rating and unsupported status convey high urgency. The most likely attack vector is a remote user submitting or uploading content that includes malformed link syntax; if the parser processes that content, a malicious payload can be rendered client-side. Because the parser operates on user-supplied data, the vulnerability is exploitable by anyone who can supply content to the affected site.