Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

GHSA-vfgc-c76h-mwh4 — drupal/core

MEDIUM

GHSA-vfgc-c76h-mwh4 is a medium-severity (CVSS 5.3) vulnerability in drupal/core. A fix is available for drupal/core — see the affected versions and patch details below.

Drupal core Cross-Site Scripting (XSS) vulnerabilities

Published
May 15, 2024
Updated
Nov 29, 2024
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Nov 29, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected
🐘drupal/core🐘drupal/core🐘drupal/core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.

Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistdrupal/core≥ 8.0.0&&< 8.9.188.9.18composer require drupal/core:^8.9.18
🐘Packagistdrupal/core≥ 9.1.0&&< 9.1.129.1.12composer require drupal/core:^9.1.12
🐘Packagistdrupal/core≥ 9.2.0&&< 9.2.49.2.4composer require drupal/core:^9.2.4

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for drupal/core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update drupal/core to 8.9.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vfgc-c76h-mwh4 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.
O3 Security · Impact-Aware SCA

Is GHSA-vfgc-c76h-mwh4 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-vfgc-c76h-mwh4: XSS (Medium 5.3) | O3 Security