Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Project:
Date:
2026-January-14
Vulnerability:
Cross-site Scripting
Affected versions:
<1.0.1
CVE IDs:
CVE-2026-0946
Description:
This module integrates the AT Internet SmartTag service.
The module does not filter administrator-entered text leading to a persistent Cross-site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer atsmarttag".
Solution:
Install the latest version and confirm the permissions associated with the module are assigned to appropriate roles.
- If you use the AT Internet SmartTag module for Drupal 9 and 10, upgrade to AT Internet SmartTag 1.0.1
Reported By:
- Pierre Rudloff (prudloff) provisional member of the Drupal Security Team
Fixed By:
Coordinated By:
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
