Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

Affected Packages

Packagist drupal/core

Affected versions: 8.8.0 (fixed in 8.8.10)

Packagist drupal/core

Affected versions: 8.9.0 (fixed in 8.9.6)

Packagist drupal/core

Affected versions: 9.0.0 (fixed in 9.0.6)

Packagist drupal/core

Affected versions: 7.0.0 (fixed in 7.73)

Packagist drupal/drupal

Affected versions: 7.0.0 (fixed in 7.73)

Packagist drupal/drupal

Affected versions: 8.8.0 (fixed in 8.8.10)

Packagist drupal/drupal

Affected versions: 8.9.0 (fixed in 8.9.6)

Packagist drupal/drupal

Affected versions: 9.0.0 (fixed in 9.0.6)

Related CVEs

CVE-2020-13666

Key Information

GHSA ID

GHSA-8jj2-x2gc-ggm7

Published

May 24, 2022 5:49 PM

Last Modified

April 23, 2024 10:29 PM

CVSS Score

5.0 /10

Primary Ecosystem

Packagist

Primary Package

drupal/core

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.