PT-2026-23112 · Drupal+2 · Google Analytics 4+1

Greg Knaddison + 3 · Published 2026-03-04 · Updated 2026-03-26 · CVE-2026-3529

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Google Analytics GA4 versions prior to 1.1.14

Description The Google Analytics GA4 module does not properly sanitize custom attributes added to the script tag used to load the Google Analytics library, leading to a Cross-Site Scripting (XSS) issue. An attacker with the "ga4 configure" or "administer google analytics ga4 settings" permission could inject malicious JavaScript through event handlers, such as onload, or override the script source. This could result in a Cross-Site Scripting (XSS) attack on all pages where the GA4 script is loaded.

Recommendations Update to version 1.1.14 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3529

DRUPAL-CONTRIB-2026-024

Affected Products

Google Analytics 4

Drupal/Ga4 Google Analytics

References · 4

• https://drupal.org/sa-contrib-2026-024 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3529 · Security Note
• https://twitter.com/CVEnew/status/2037280555176517854 · Twitter Post