Security Updates Fix Entity Browser XSS and Edit in-place field Access Bypass

Two Drupal contributed modules received Moderately Critical security updates on 5 August 2026. The Drupal Security Team published separate advisories for a stored cross-site scripting vulnerability in Entity Browser and an access-bypass vulnerability in Edit in-place field. The issues are assigned CVE-2026-18986 and CVE-2026-18985, respectively.

The advisories share a Moderately Critical rating but describe different exposure conditions. Entity Browser scores 12 out of 25 and requires administrator-level access, while Edit in-place field scores 14 out of 25 and requires user-level access through a module-specific permission. Under the Drupal Security Team's risk definitions, Entity Browser's TD:Default rating means default or common configurations are exploitable but a configuration change can disable the exploit, while the TD:All rating for Edit in-place field means all module configurations are affected when the attacker's access prerequisite is met.

Entity Browser does not sufficiently sanitise tab titles, allowing stored cross-site scripting when an attacker can insert HTML with specific attributes on a page displaying an entity browser. The advisory does not identify the configuration change that would disable the exploit. It lists versions earlier than 2.16.0 as affected and directs users to upgrade to Entity Browser 8.x-2.16. Drupal.org reports that about 97,000 sites use the module, indicating a comparatively broad deployment footprint without establishing that every reported installation is vulnerable.

Edit in-place field does not sufficiently check entity access when processing edits. According to the advisory, a malicious user can craft requests that modify any field on any entity if their role has the edit in place field editing permission permission. Versions earlier than 2.1.1 are affected. Release 2.1.1 contains the security fix.

Both advisories assign an E:Theoretical exploit rating. Drupal defines that rating as indicating that no public exploit code or documentation for developing an exploit was known when the issue was assessed. Maintainers running affected releases should update to Entity Browser 8.x-2.16 and Edit in-place field 2.1.1 rather than treating the shared Moderately Critical label as evidence that the two vulnerabilities have identical prerequisites or exposure.