GHSA-c533-c843-67h8
GitHub Security Advisory
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Affected Packages
Packagist
drupal/core
Affected versions:
8.0.0
(fixed in 8.8.10)
Packagist
drupal/core
Affected versions:
8.9.0
(fixed in 8.9.6)
Packagist
drupal/core
Affected versions:
9.0.0
(fixed in 9.0.6)
Packagist
drupal/drupal
Affected versions:
8.0.0
(fixed in 8.8.10)
Packagist
drupal/drupal
Affected versions:
8.9.0
(fixed in 8.9.6)
Packagist
drupal/drupal
Affected versions:
9.0.0
(fixed in 9.0.6)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: June 18, 2025 6:25 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.