{"id":"CVE-2026-110738","summary":"Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219","details":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.","aliases":["DRUPAL-CONTRIB-2026-219"],"modified":"2026-11-08T02:30:55.591568370Z","published":"2026-10-30T03:09:53.718Z","database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110738.json","cna_assigner":"drupal"},"references":[{"type":"WEB","url":"https://git.drupalcode.org/project/gin"},{"type":"WEB","url":"https://www.drupal.org/project/gin"},{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-219"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110738.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110738"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.drupalcode.org/project/gin","events":[{"introduced":"0"},{"fixed":"469a766b2f1416ab0fe923395c4ca39461ca60d2"},{"introduced":"e0e42aae84bcc978c6a992b7b82c4956f10babed"},{"fixed":"cbb271ec8655495e61436049dd4c1c7ec780c669"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.0.0"},{"fixed":"4.1.4"}]},{"range":[{"introduced":"5.0.0"},{"fixed":"5.0.16"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["5.0.15","5.0.14","5.0.13","4.1.3","5.0.12","5.0.11","5.0.10","4.1.2","5.0.9","5.0.8","5.0.7","5.0.6","5.0.5","4.1.1","5.0.4","5.0.3","4.1.0","5.0.2","5.0.1","5.0.0","4.0.6","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","4.0.0","8.x-3.0-rc11","8.x-3.0-rc10","8.x-3.0-rc9","8.x-3.0-rc8","8.x-3.0-rc7","8.x-3.0-rc6","8.x-3.0-rc5","8.x-3.0-rc4","8.x-3.0-rc3","8.x-3.0-rc2","8.x-3.0-rc1","8.x-3.0-beta5","8.x-3.0-beta4","8.x-3.0-beta3","8.x-3.0-beta2","8.x-3.0-beta1","8.x-3.0-alpha37","8.x-3.0-alpha36","8.x-3.0-alpha35","8.x-3.0-alpha34","8.x-3.0-alpha33","8.x-3.0-alpha32","8.x-3.0-alpha31","8.x-3.0-alpha30","8.x-3.0-alpha29","8.x-3.0-alpha28","8.x-3.0-alpha27","8.x-3.0-alpha26","8.x-3.0-alpha25","8.x-3.0-alpha24","8.x-3.0-alpha23","8.x-3.0-alpha22","8.x-3.0-alpha21","8.x-3.0-alpha20","8.x-3.0-alpha19","8.x-3.0-alpha18","8.x-3.0-alpha17","8.x-3.0-alpha16","8.x-3.0-alpha15","8.x-3.0-alpha14","8.x-3.0-alpha13","8.x-3.0-alpha12","8.x-3.0-alpha11","8.x-3.0-alpha10","8.x-3.0-alpha9","8.x-3.0-alpha8","8.x-3.0-alpha7","8.x-3.0-alpha6","8.x-3.0-alpha5","8.x-3.0-alpha4","8.x-3.0-alpha3","8.x-3.0-alpha2","8.x-3.0-alpha1","8.x-2.0-alpha13","8.x-2.0-alpha12","8.x-2.0-alpha11","8.x-2.0-alpha10","8.x-2.0-alpha9","8.x-2.0-alpha8","8.x-2.0-alpha7","8.x-2.0-alpha6","8.x-2.0-alpha5","8.x-2.0-alpha4","8.x-2.0-alpha3","8.x-2.0-alpha2","8.x-2.0-alpha1","8.x-1.0-alpha3","8.x-1.0-alpha2","8.x-1.0-alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110738.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"}]}