Executive brief
Drupal is a popular open-source content management system used to build and manage websites. A security flaw in the CKEditor 5 component allows malicious scripts to be injected into the site through entity suggestions. If exploited, an attacker could perform unauthorized actions in a victim's browser, potentially leading to account takeover or the theft of sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Drupal core versions 11.3.0 through 11.3.6. The flaw is located in the CKEditor 5 integration, specifically within the feature that provides entity suggestions when adding links. The application fails to sufficiently sanitize these suggestions, allowing a malicious user to inject and store arbitrary scripts. When another user interacts with the affected component, the script executes in their browser context. This can lead to session hijacking or unauthorized data access. The issue is resolved in Drupal 11.3.7.
Affected products
- Drupal Drupal core >= 11.3.0, < 11.3.7
Timeline
- 2026-04-15: advisory: Vendor advisory SA-CORE-2026-003 released
- 2026-05-19: disclosed: NVD publication date
- 2026-05-20: advisory: GitHub Advisory published