May I please reserve a CVE ID for this exploit?

JSON file is attached. Notes on the entry:

  • I'll add the reference to our directory entry after I get the ID and we publish our writeup; I didn't see one for Tag1 but if they comment with it I'll add it.
  • The vector works out to be CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N → 4.8 (Medium)

Additional input is very welcome. This is not yet ready to publish (still need that ref URL) but it is ready for review.

CommentFileSizeAuthor
#11 CVE-2026-0748-i18-11.json_.txt4.38 KBaangel
#6 CVE-2026-0748-i18n.txt4.25 KBaangel
CVE-2025-i18n.txt4.06 KBaangel

Comments

aangel created an issue. See original summary.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs review

Thanks aangel.

I'll adjust the status since there is a file to review.

aangel’s picture

aangel commented

Whoops, forgot that. Thanks.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Title: CVE ID Request for i18n node submodule » CVE Request for i18n node submodule - CVE-2026-0748
Status: Needs review » Needs work

OK, I reserved CVE-2026-0748 for this.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Still working on this? We should either publish the details or somehow stop using this CVE (e.g. reject it)

aangel’s picture

aangel commented
StatusFileSize
new CVE-2026-0748-i18n.txt4.25 KB

Yes, have a new entry ready with the following changes:
1. Uses the ID.
2. Now uses D7-style version numbers.
3. Sets the package collection to https://www.drupal.org/project/i18n
4. I've added a link to our directory entry.
5. I was unable to find an entry in the Tag1 directory.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Needs work » Needs review

OK, thanks.

I found this page for tag1 which I can add as a related article at the time of publishing.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

The page: https://d7es.tag1.com/node/86

aangel’s picture

aangel commented

They appear to have a bug or content issue for this entry because when I select i18n in their drop-down, I get an empty response.

https://d7es.tag1.com/security-advisories?field_project_target_id=70

So roger for that link.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

That's odd - it shows in the list for me, but definitely could be some kind of bug.

aangel’s picture

aangel commented
StatusFileSize
new CVE-2026-0748-i18-11.json_.txt4.38 KB

Sorted it out. The dropdown includes the module entry for both Announcements and Security Advisories but produces a result only for Announcements.

I've added the Tag1 entry and set the date to their published date (June 11, 2025).

aangel’s picture

aangel commented

Bumping.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Needs review » Fixed

I changed the versions to be custom instead of semver and published this. Thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.