SA-CORE-2026-013: XSS
The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's security advisory:
High-severity Cross-site scripting (XSS) in the engine package
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.4.7Fixed in 11.3.17Fixed in 10.6.17
Event History
Frequently Asked Questions
Who is exposed to this issue?
Drupal sites configured to use CKEditor for WYSIWYG editing may be affected. Users with privileged access to the WYSIWYG CKEditor, including site administrators, are potential targets.
What level of access does an attacker need?
An attacker needs the ability to create or edit content. They may be able to exploit the issue even if they do not have access to CKEditor themselves.
How could this affect administrators?
The issue may allow cross-site scripting payloads created or edited by a lower-privileged content user to target users who access content through the WYSIWYG CKEditor. This includes administrators with privileged access.