CVE-2026-58588

MediumCVSS 6.1

Published: 10/07/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session theft, redirects, or data theft.

Recommendation

Upgrade Drupal Canvas to version 1.4.3, 1.5.3, 1.6.2, or 1.7.2 (depending on the branch), which include a fix for input neutralization.

Other vulnerabilities in Drupal Canvas

CVE-2026-58587Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS