PT-2026-23112 · Drupal+2 · Google Analytics 4+1

Greg Knaddison + 3 · Publicado 2026-03-04 · Atualizado 2026-03-26 · CVE-2026-3529

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Google Analytics GA4 versions prior to 1.1.14

Description The Google Analytics GA4 module does not properly sanitize custom attributes added to the script tag used to load the Google Analytics library, leading to a Cross-Site Scripting (XSS) issue. An attacker with the "ga4 configure" or "administer google analytics ga4 settings" permission could inject malicious JavaScript through event handlers, such as onload, or override the script source. This could result in a Cross-Site Scripting (XSS) attack on all pages where the GA4 script is loaded.

Recommendations Update to version 1.1.14 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3529

DRUPAL-CONTRIB-2026-024

Produtos afetados

Google Analytics 4

Drupal/Ga4 Google Analytics

Referências · 4

• https://drupal.org/sa-contrib-2026-024 · Aviso do Fabricante
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-024 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3529 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037280555176517854 · Publicação no Twitter