AIKIDO-2026-324263

TL;DR

The Menu Link Attributes module lets site builders attach HTML attributes to menu links and to the list item (<li>) that wraps each link. Affected versions copy those container attributes onto the <li> without the sanitization Drupal core applies to attributes on the link itself, so a configured name such as an event handler (on*), style, or a name that is not a plain HTML attribute is rendered into the menu markup. A visitor who loads a page showing that menu can then run the injected script. Exploitation requires the "Administer menus and menu links" and "Use menu link attributes" permissions, and an unsafe container attribute must already have been configured by a user with "Administer menu link attributes". The default configuration is not affected. The fix rejects those attribute names in configuration, filters container attributes with the same rules core uses for link attributes before rendering, and a database update removes any unsafe definitions already stored and clears the render cache.