# CVE-2026-6367: Drupal Drupal core stored XSS in CKEditor 5 entity suggestions

Source: https://junglewise.ai/threats/cve-2026-6367-drupal-drupal-core-stored-xss-in-ckeditor-5-entity-suggestions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-6367 · Severity: medium · CVSS 6.1 · Published 2026-05-19

Drupal is a popular open-source content management system used to build and manage websites. A security flaw in the CKEditor 5 component allows malicious scripts to be injected into the site through entity suggestions. If exploited, an attacker could perform unauthorized actions in a victim's browser, potentially leading to account takeover or the theft of sensitive session information.

Technologies: [Drupal](https://junglewise.ai/threats/technologies/drupal), [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-6367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6367 being exploited in the wild.

**How severe is CVE-2026-6367?** Medium severity, with a CVSS score of 6.1, published 19 May 2026.

**Which products and versions are affected?** Drupal >= 11.3.0, < 11.3.7; drupal/core (Packagist) ECOSYSTEM:introduced=11.3.0,fixed=11.3.7.

**Is there a fix for CVE-2026-6367?** Yes. drupal/core (Packagist): upgrade to 11.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6367 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-6367?** Check whether you run Drupal or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- drupal/core (Packagist): upgrade to 11.3.7 or later

  ```sh
  composer require drupal/core:^11.3.7
  ```


## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Drupal core versions 11.3.0 through 11.3.6. The flaw is located in the CKEditor 5 integration, specifically within the feature that provides entity suggestions when adding links. The application fails to sufficiently sanitize these suggestions, allowing a malicious user to inject and store arbitrary scripts. When another user interacts with the affected component, the script executes in their browser context. This can lead to session hijacking or unauthorized data access. The issue is resolved in Drupal 11.3.7.

## Affected products

- Drupal Drupal core >= 11.3.0, < 11.3.7

## Identifiers

- CVE-2026-6367
- DRUPAL-CORE-2026-003
- GHSA-pw6f-3999-xp7g

## Timeline

- 2026-04-15: advisory: Vendor advisory SA-CORE-2026-003 released
- 2026-05-19: disclosed: NVD publication date
- 2026-05-20: advisory: GitHub Advisory published

## References

- [https://www.drupal.org/sa-core-2026-003](https://www.drupal.org/sa-core-2026-003)

## Related threats

- [Drupal core Link module cross-site scripting in markup sanitization](https://junglewise.ai/threats/cve-2026-108515-drupal-core-2026-015-the-drupal-core-link-module-provides-a)
- [Drupal Navigation module cross-site scripting in attributes](https://junglewise.ai/threats/cve-2026-108514-drupal-core-2026-016-the-navigation-module-doesn-t-sufficiently)
- [Drupal Core remote code execution in Field UI module](https://junglewise.ai/threats/cve-2026-108097-drupal-core-2026-014-a-remote-code-execution-vulnerability)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [Drupal stored cross-site scripting in Layout Builder](https://junglewise.ai/threats/cve-2026-55805-drupal-stored-cross-site-scripting-in-layout-builder)