CVE-2026-8493

MediumCVSS 5.4

Published: 19/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Colorbox Inline module for Drupal is vulnerable to Cross-Site Scripting (XSS) in all versions before 2.1.1. The vulnerability is due to improper neutralization of input during web page generation.

Risk Assessment

An attacker can inject malicious JavaScript code that executes in the victim's browser, potentially leading to session theft or other harmful actions.

Recommendation

Update the Colorbox Inline module to version 2.1.1 or later.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS). This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.