{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-10770","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-10770\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-10770\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/2116907","id":"2116907","resource":"node"},"field_sa_advisory_id":"042","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/drumm\u0022 rel=\u0022nofollow\u0022\u003ENeil Drumm (drumm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Complex\/A:Admin\/CI:Some\/II:Some\/E:Theoretical\/TD:Uncommon","field_sa_description":{"value":"\u003Cp\u003EThis module provides spam protection using the CleanTalk cloud service.\u003C\/p\u003E\n\u003Cp\u003EThe module doesn\u0027t sufficiently sanitize API response messages before rendering them in HTML output. The \u003Ccode class=\u0022language-php\u0022\u003E_cleantalk_die()\u003C\/code\u003E and \u003Ccode class=\u0022language-php\u0022\u003Ect_die()\u003C\/code\u003E functions output the CleanTalk API response message directly into HTML without proper sanitization, allowing potential injection of arbitrary HTML or JavaScript.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that an attacker must be able to influence the CleanTalk cloud API response (e.g., through a man-in-the-middle attack or a compromised API server).\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/alexandergull\u0022 rel=\u0022nofollow\u0022\u003Ealexandergull\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/anton1211\u0022 rel=\u0022nofollow\u0022\u003Eanton1211\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/ram4nd\u0022 rel=\u0022nofollow\u0022\u003ERa M\u00e4nd (ram4nd)\u003C\/a\u003E provisional member of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/ram4nd\u0022 rel=\u0022nofollow\u0022\u003ERa M\u00e4nd (ram4nd)\u003C\/a\u003E provisional member of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the Anti-Spam by CleanTalk module for Drupal upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/cleantalk\/releases\/9.7.1\u0022 rel=\u0022nofollow\u0022\u003EAnti-Spam by CleanTalk 9.7.1\u003C\/a\u003E\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Cross site scripting","field_issue_last_status_change":"1780503296","field_sa_cve":["CVE-2026-10770"],"field_is_psa":"0","field_affected_versions":"\u003C9.7.1","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3589870","id":"3589870","resource":"node"}],"nid":"3590085","vid":"14368091","is_new":false,"type":"sa","title":"Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-042","edit_url":"https:\/\/www.drupal.org\/node\/3590085\/edit","status":"1","promote":"0","sticky":"0","created":"1780503296","changed":"1780503296","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16600657","id":16600657,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16600666","id":16600666,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16600667","id":16600667,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16600668","id":16600668,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16606164","id":16606164,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16606165","id":16606165,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1780503296"}]}