1 line
1.4 KiB
JSON
1 line
1.4 KiB
JSON
{"schema_version":"1.9.0","id":"DRUPAL-CORE-2026-003","published":"2026-04-15T19:27:21Z","modified":"2026-09-10T03:45:14.656374508Z","aliases":["BIT-drupal-2026-6367","CVE-2026-6367","GHSA-pw6f-3999-xp7g"],"details":"Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.\n\nThe suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.","affected":[{"package":{"name":"drupal/core","ecosystem":"Packagist","purl":"pkg:composer/drupal/core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.3.0"},{"fixed":"11.3.7"}],"database_specific":{"constraint":">= 11.3.0 < 11.3.7"}}],"versions":["11.3.0","11.3.1","11.3.2","11.3.3","11.3.4","11.3.5","11.3.6"],"database_specific":{"affected_versions":">= 11.3.0 < 11.3.7","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/core/DRUPAL-CORE-2026-003.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-core-2026-003"}],"credits":[{"name":"Dmitrijs Trizna (dtrizna)","contact":["https://www.drupal.org/u/dtrizna"]},{"name":"Dries Buytaert (dries)","contact":["https://www.drupal.org/u/dries"]},{"name":"Shirsendu Mondal","contact":["https://www.drupal.org/u/shirsendu-mondal"]},{"name":"cantina_security","contact":["https://www.drupal.org/u/cantina_security"]}]} |