Executive brief
Drupal is a web content management system widely used to power websites. The WYSIWYG editor in Drupal integrates CKEditor, a third-party library for rich text editing. An authenticated attacker who can create or edit content could inject malicious JavaScript to compromise site administrators and other privileged users who interact with the editor. This could lead to account takeover, malware distribution, or sensitive data theft.
Technical details
CKEditor 5 contains a stored cross-site scripting (XSS) vulnerability in its engine that can be exploited through malicious content submission. An attacker with content creation or editing permissions (but not necessarily direct CKEditor access) can craft payloads that execute JavaScript in the browser of users viewing or editing the content via CKEditor, including site administrators. A fix is available in Drupal 10.6.17, 11.3.17, and 11.4.7.
Affected products
- Drupal Drupal 10.5.0–10.6.16, 11.0.0–11.3.16, 11.4.0–11.4.6
- CKSource CKEditor 5 affected version range not specified in advisory
Timeline
- 2026-09-16: disclosed