Project: 
Address Suggestion
Date: 
2026-August-26
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross-site scripting
Affected versions: 
<1.0.25
CVE IDs: 
CVE-2026-81167
Description: 

The Address Suggestion module provides address autocomplete functionality using configured address providers.

The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must be able to inject malicious content into data returned by a configured address provider, and a user must perform a search that returns the malicious suggestion.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: