CVE-2026-114536 in USWDS Paragraph Components
Summary
by MITRE • 10/30/2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability exists within the USWDS Paragraph Components module for Drupal, affecting versions ranging from 0.0.0 up to and including version 3.1.3. The core technical deficiency lies in the application's failure to adequately sanitize user-supplied input before it is rendered into HTML output by the web server. When a malicious actor submits data containing executable script payloads through any of the affected paragraph components, the system processes this input without applying necessary encoding or validation rules. Consequently, when other users subsequently view the content generated from these inputs, their browsers execute the embedded scripts within the context of the vulnerable website's domain. This mechanism classifies the issue as a Stored XSS vulnerability because the malicious payload is persistently saved on the target server rather than being delivered via a one-time link in Reflected XSS scenarios.
From an operational perspective, this vulnerability poses significant risks to both end-users and system administrators. Because the script executes within the trusted context of the Drupal site, attackers can bypass same-origin policy restrictions that typically limit what scripts can do. This allows for severe consequences such as session hijacking, where the attacker steals authentication cookies or tokens to impersonate legitimate users. It also enables credential harvesting through fake login forms injected into the page content, defacement of the website by altering displayed text and images, and redirection of victims to malicious external sites designed for phishing attacks. In environments with privileged user accounts, such as administrators viewing compromised content in their dashboards, the impact is amplified significantly, potentially leading full compromise of the underlying Drupal installation and associated databases. The persistence of the payload means that every visitor who loads the affected page becomes a potential victim without any additional interaction required from them beyond loading the webpage.
The technical classification aligns with CWE-79, which covers Improper Neutralization of Script-Related HTML Tags in Web Pages, highlighting the failure to neutralize special characters like angle brackets and quotes that define script boundaries. Furthermore, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within a browser environment. The attack vector typically involves an attacker crafting malicious content using HTML tags such as img with onerror attributes or svg elements containing javascript protocols. Since the USWDS Paragraph Components module is designed for flexible content creation in Drupal, it likely accepts rich text input from various user roles without sufficiently stripping out dangerous scripting constructs during the sanitization phase of data processing. This lack of robust output encoding allows raw script blocks to persist in the database and be served directly to clients upon request.
Mitigation strategies must focus on immediate remediation through software updates and enhanced security configurations. The primary recommendation is to upgrade the USWDS Paragraph Components module to a version later than 3.1.3, where developers have presumably implemented stricter input validation and output encoding mechanisms. If upgrading is not immediately feasible due to compatibility constraints with other modules or custom code, administrators should employ web application firewall rules to detect and block common XSS payloads in HTTP requests targeting the affected endpoints. Additionally, enabling Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to load, thereby preventing inline script execution even if an injection attempt succeeds. Regular security audits of custom code interacting with these components and enforcing strict role-based access controls for content creation can further reduce the attack surface available to potential adversaries seeking to exploit this flaw.