—
DRUPAL-CONTRIB-2026-137
Details
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed.
The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/feed_block
Introduced in:
0Fixed in: 2.0.2Upgrade drupal/feed_block to 2.0.2 or newer (ecosystem packagist:https://packages.drupal.org/8).