Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

{
  "id": "016e287a466341e0f939d44a69909837e362ab346884ae55c995838e86cf7da6",
  "url": "https://www.drupal.org/sa-core-2026-013",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013",
    "summary": "A CKEditor vulnerability can enable cross-site scripting when Drupal is configured to use CKEditor for WYSIWYG editing. Update Drupal core to a listed fixed release.",
    "evidence": "The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.",
    "products": [
      {
        "name": {
          "value": "Drupal core",
          "evidence": "Project: Drupal core"
        },
        "prerequisites": [
          {
            "value": "Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing.",
            "evidence": "Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing."
          }
        ],
        "fixed_versions": [
          {
            "value": "Drupal 11.4.7",
            "evidence": "If you use Drupal 11.4.x, update to Drupal 11.4.7."
          },
          {
            "value": "Drupal 11.3.17",
            "evidence": "If you use Drupal 11.3.x, update to Drupal 11.3.17."
          },
          {
            "value": "Drupal 10.6.17",
            "evidence": "If you use Drupal 10.6.x, update to Drupal 10.6.17."
          }
        ],
        "affected_versions": [
          {
            "value": ">=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7",
            "evidence": "Affected versions: >=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-drupal-security",
  "document_id": 23454,
  "published_at": "2026-09-16T16:21:04+00:00"
}