Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Affected Packages

Packagist drupal/core

Affected versions: 7.0.0 (fixed in 7.80)

Packagist drupal/core

Affected versions: 8.0.0 (fixed in 8.9.14)

Packagist drupal/core

Affected versions: 9.0.0 (fixed in 9.0.12)

Packagist drupal/core

Affected versions: 9.1.0 (fixed in 9.1.7)

Packagist drupal/drupal

Affected versions: 7.0.0 (fixed in 7.80)

Packagist drupal/drupal

Affected versions: 8.0.0 (fixed in 8.9.14)

Packagist drupal/drupal

Affected versions: 9.0.0 (fixed in 9.0.12)

Packagist drupal/drupal

Affected versions: 9.1.0 (fixed in 9.1.7)

Related CVEs

CVE-2020-13672

Key Information

GHSA ID

GHSA-3m36-mjwj-352c

Published

February 12, 2022 12:00 AM

Last Modified

May 15, 2024 8:51 PM

CVSS Score

5.0 /10

Primary Ecosystem

Packagist

Primary Package

drupal/core

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.