CVE-2026-84915 in Component blocks Plugin
Summary
by MITRE • 10/23/2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified security flaw resides within the Drupal Component Blocks module, specifically affecting version ranges from 0.0.0 through 1.2.7. This vulnerability is classified as an Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. The specific manifestation of this issue allows for Stored XSS attacks, which represents a more severe category of web application vulnerabilities compared to reflected variants because the malicious payload is persistently stored on the target server rather than being transiently passed via URL parameters or form submissions.
The technical root cause lies in insufficient input validation and output encoding mechanisms within the Component Blocks module when processing user-supplied data for block content. When an authenticated user with sufficient permissions creates or edits a component block, the system fails to adequately sanitize special characters that have executable script implications. Consequently, arbitrary JavaScript code can be embedded directly into the stored content of these blocks. This failure aligns closely with CWE-79, which defines Cross-site Scripting as a weakness where web applications include untrusted data in their output without proper validation or escaping.
The operational impact of this vulnerability is significant due to its persistent nature. Once an attacker successfully injects malicious script code into a component block, that payload becomes part of the site's content and will be executed by every user who views the affected page where the block is rendered. This allows attackers to steal session cookies, hijack administrative sessions, perform actions on behalf of victims without their consent, or redirect users to phishing sites. In environments with multiple users, a single injection can compromise numerous accounts simultaneously, leading to widespread data exfiltration and loss of integrity for the web application.
From an adversary perspective, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution within browser contexts. Attackers leverage Stored XSS as a primary vector for initial access or privilege escalation in many attack chains. The persistence of the payload means that even if the attacker's original entry point is patched or blocked, the malicious code remains active on the server until manually removed by an administrator, creating a long-term backdoor-like effect within the application logic.
Mitigation strategies must focus on immediate remediation and future prevention. Administrators should upgrade the Component Blocks module to version 1.2.8 or later, where this input handling flaw has been addressed with robust sanitization routines. For systems unable to update immediately due to compatibility constraints, implementing a Web Application Firewall rule that detects and blocks common XSS payloads in block content fields can provide temporary protection. Additionally, enforcing strict Content Security Policy headers on the Drupal site can limit the execution of inline scripts, thereby reducing the impact even if an injection occurs. Regular security audits focusing on input validation across all user-facing modules are recommended to prevent similar flaws from emerging in other components.