Drupal security updates, in plain English

Week of 5 August 2026

Drupal publishes security updates on Wednesdays. This week there were 2, all for modules.

None for Drupal core, so nothing here applies to every site.

Each card says what the module does, what went wrong, who could do it, whether it applies to you, how urgent it is, and the one line to send to your developer. Worst rated first, and most used first within a rating.

New here? How Drupal security updates work explains who publishes these, why they matter and what the ratings mean. Earlier weeks and a search by module are on the main page.

Moderately critical: 2 updates

Include in your next routine update, within the month.

Entity Browser

Moderately critical · 106,946 sites report using it · SA-CONTRIB-2026-094 · on drupal.org

This module provides a tool to pick and select pieces of content on a website.

An administrator account could add malicious code to the titles of tabs. This code would run when other people view the tool. The attacker could then view hidden information or change data on the website.

Who could do thisOnly someone with an administrator login.
Does it apply to youThis applies to any site where an attacker can insert specific code on a page that shows the selection tool.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Entity Browser to 8.x-2.16.

For developers: what the fix changed

The fix sanitises the tab title by wrapping it in Drupal.checkPlain in the js/entity_browser.tabs.js file.

8.x-2.15 to 8.x-2.16 1 commit, 1 file.

js/entity_browser.tabs.js +1 −1 fix

Full diff, 8.x-2.15 to 8.x-2.16

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Edit in-place field

Moderately critical · 168 sites report using it · SA-CONTRIB-2026-093 · on drupal.org

This module allows people to edit pieces of content directly while viewing them.

An ordinary account on the site could bypass access rights to change any part of any piece of content. They could also view private information stored in those items.

Who could do thisOnly someone with a login on your site.
Does it apply to youThis applies to any site where an attacker has the edit in place field editing access right.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Edit in-place field to 2.1.1.

For developers: what the fix changed

The fix adds entity update and field edit access checks in `EditInPlaceFormBase::loadEntity` and updates `processRequest` to retrieve form data from `$form_state` instead of the raw request to prevent tampering.

Also in this release Fixed schema errors and added tests.

2.1.0 to 2.1.1 2 commits, 5 files including 3 tests.

config/schema/edit_in_place_field.schema.yml +1 −5
src/Form/EditInPlaceFormBase.php +36 −27 fix

Full diff, 2.1.0 to 2.1.1

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Not sure what your site is running?

Send me your Drupal site's address.

I'll tell you what I can see from outside, what the Drupal 10 end of life on 9 December means for it, and what it would cost to have me keep it patched. There's no charge for that and no obligation. peter@peterbrady.co.uk

Compiled 10 October 2026 as part of the archive back to January 2026, from the advisories published by the Drupal security team on drupal.org. The facts on each card are theirs. The plain English is mine, with help from a language model. In the archive the cards rated critical or above were read before publishing and the rest were checked by sampling. Install counts are today's, not the count on the day of the advisory.

Week of 5 August 2026

Moderately critical: 2 updates

Entity Browser

Edit in-place field

Send me your Drupal site's address.

Get in touch

Links

Reference