« Volver al listado

CVE-2026-4093

Estado: AnalizadaMedia (5.1)—

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.

Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered.

Vector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed.

Leer descripción completaMostrar menos

Exploit affects versions 7.x-1.x up to and including 7.x-1.11.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Taxonomy Term Reference Tree Widget Project — Taxonomy Term Reference Tree Widget

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-4093",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-4093",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-22T13:23:03.434925Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "mlhess@drupal.org",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/term_reference_tree",
          "vendor": "Drupal",
          "product": "Term Reference Tree",
          "versions": [
            {
              "status": "affected",
              "version": "7.x-1.x",
              "versionType": "custom",
              "lessThanOrEqual": "7.x-1.11"
            }
          ],
          "packageName": "Term Reference Tree",
          "collectionURL": "https://www.drupal.org/project/term_reference_tree",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-21T22:16:48.290",
  "references": [
    {
      "url": "https://d7es.tag1.com/security-advisories/taxonomy-term-reference-tree-widget-moderately-critical-cross-site-scripting",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "mlhess@drupal.org"
    },
    {
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2026-4093",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.\n\nVector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered.\n\nVector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed.\n\nExploit affects versions 7.x-1.x up to and including 7.x-1.11."
    },
    {
      "lang": "es",
      "value": "En el módulo Drupal 7 Term Reference Tree, existen dos vectores de XSS almacenado en la cadena de renderizado de widgets/formatters.\n\nVector A (plantillas de visualización de tokens): Cuando el módulo Token está habilitado y las plantillas de visualización de tokens están configuradas, la salida de token controlada por el atacante (p. ej., descripción del término) se renderiza sin la sanitización adecuada. Cualquier usuario que pueda editar los términos de taxonomía referenciados puede inyectar HTML/JS que se ejecuta cuando se renderiza el campo.\n\nVector B (renderizado de etiquetas de término): Las etiquetas de los términos de taxonomía no se sanitizan correctamente antes de ser renderizadas en el widget, lo que permite a un usuario con permiso para crear o editar términos de taxonomía inyectar scripts en el nombre del término que se ejecutan cuando se visualiza un formulario que contiene el widget.\n\nEl exploit afecta a las versiones 7.x-1.x hasta la 7.x-1.11 inclusive."
    }
  ],
  "lastModified": "2026-07-23T16:10:00.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:taxonomy_term_reference_tree_widget_project:taxonomy_term_reference_tree_widget:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3390651C-0E1A-4B4C-837A-A8740627DFD5",
              "versionEndExcluding": "7.x-1.12",
              "versionStartIncluding": "7.x-1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}