Project:
Date:
2026-July-22
Security risk:
Vulnerability:
Cross-site Scripting
Affected versions:
<1.12.0
CVE IDs:
CVE-2026-16640
Description:
This module enables you to add autocomplete suggestions for search forms created with the Search API module.
The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that the web server must be configured to display warning messages to users.
Solution:
Install the latest version:
- If you use the Search API Autocomplete module, upgrade to Search API Autocomplete 8.x-1.12
Another option for sites unable to update is to set display_errors: off in php.ini (or similar settings) to disable the exploit.
Reported By:
Coordinated By:
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
