[IT-SecNots] [Security-news] Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-core-2026-013

Project: Drupal core [1]
Project machine name: drupal
Date: 2026-September-16
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Third-party libraries

Affected versions: >=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0
<11.4.7
Description: 
The Drupal project uses the CKEditor [3] library for WYSIWYG editing.
CKEditor has released a security update that impacts Drupal [4].

Vulnerabilities are possible if Drupal is configured to use CKEditor for
WYSIWYG editing. An attacker that can create or edit content (even without
access to CKEditor themselves) may be able to exploit this Cross-Site
Scripting (XSS) vulnerability to target users with access to the WYSIWYG
CKEditor, including site admins with privileged access.

For more information, see CKEditor's security advisory:

 * High-severity Cross-site scripting (XSS) in the engine package [5]

Solution: 
Install the latest version:

*Drupal 11*

 * If you use Drupal 11.4.x, update to Drupal 11.4.7 [6].
 * If you use Drupal 11.3.x, update to Drupal 11.3.17 [7].
 * Drupal 11.2.x and below are end-of-life and do not receive security
   coverage.

*Drupal 10*

 * If you use Drupal 10.6.x, update to Drupal 10.6.17 [8].
 * Drupal 10.5.x and below are end-of-life and do not receive security
   coverage.

Note that Drupal 8  [9] and Drupal 9 [10] have both reached end-of-life.

.... Instructions for contributed modules

Site owners should also review their site following the protocol for managing
external libraries and plugins [11], as contributed projects may use
additional CKEditor plugins not packaged in Drupal core.

CKEditor has also released another CVE in today's release that does not
affect Drupal, but may affect custom plugins or other usecases:

 * Low-severity Cross-site scripting (XSS) in the engine package [12]

Reported By: 
 * Piotrek Koszuliński (Reinmar) [13]

Fixed By: 
 * catch (catch) [14] of the Drupal Security Team
 * Lee Rowlands (larowlan) [15] of the Drupal Security Team
 * Mohit Aghera (mohit_aghera) [16], provisional member of the Drupal
   Security Team
 * Jess  (xjm) [17] of the Drupal Security Team

Coordinated By: 
 * Bram Driesen (bramdriesen) [18] of the Drupal Security Team
 * catch (catch) [19] of the Drupal Security Team
 * Greg Knaddison (greggles) [20] of the Drupal Security Team
 * Lee Rowlands (larowlan) [21] of the Drupal Security Team
 * Dave Long (longwave) [22] of the Drupal Security Team
 * Jess  (xjm) [23] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [24]

[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://github.com/ckeditor/ckeditor5
[4]  
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp
[5]  
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp
[6] https://www.drupal.org/project/drupal/releases/11.4.7
[7] https://www.drupal.org/project/drupal/releases/11.3.17
[8] https://www.drupal.org/project/drupal/releases/10.6.17
[9] https://www.drupal.org/psa-2021-06-29
[10] https://www.drupal.org/psa-2023-11-01
[11] https://www.drupal.org/psa-2011-002
[12]  
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq
[13] https://www.drupal.org/u/reinmar
[14] https://www.drupal.org/u/catch
[15] https://www.drupal.org/u/larowlan
[16] https://www.drupal.org/u/mohit_aghera
[17] https://www.drupal.org/u/xjm
[18] https://www.drupal.org/u/bramdriesen
[19] https://www.drupal.org/u/catch
[20] https://www.drupal.org/u/greggles
[21] https://www.drupal.org/u/larowlan
[22] https://www.drupal.org/u/longwave
[23] https://www.drupal.org/u/xjm
[24]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3623427

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at