CVE-2026-6367: Drupal Core 11.3 Cross-Site Scripting Vulnerability in CKEditor 5 Link Suggestions
Summary
CVE-2026-6367: Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. Affects drupal/core versions >= 11.3.0, < 11.3.7. Fixed in 11.3.7. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2026-6367 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that allows users to create and manage websites easily. It offers a flexible framework for building various types of websites, from personal blogs to complex enterprise applications. The core of Drupal includes a robust set of features, including user management, content creation, and extensibility through modules and themes. However, like any software, it is susceptible to vulnerabilities, which can compromise the security and integrity of the applications built on it.
Vulnerability Detail
The vulnerability identified as CVE-2026-6367 affects Drupal Core version 11.3, specifically in the context of CKEditor 5, a rich text editor integrated into Drupal. The issue arises from insufficient sanitization of entity suggestions when adding links, which can be exploited by a malicious user to execute stored cross-site scripting (XSS) attacks against other users. This could lead to unauthorized actions being performed on behalf of the victim or the exposure of sensitive information.
How To Fix
Minimum fixed version
11.3.7
This is the first release that contains the fix.
composer require drupal/core:11.3.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the CKEditor link suggestion feature for untrusted users until the patch is applied. This can be done by adjusting user permissions in the Drupal admin interface.
Conclusion
In summary, CVE-2026-6367 is a critical vulnerability in Drupal Core 11.3 that poses a risk of stored cross-site scripting attacks. Users are strongly advised to update to version 11.3.7 or later to mitigate this risk. Additionally, temporary workarounds can be implemented to protect against potential exploitation until the update is completed.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2026-6367 is a vulnerability in Drupal Core 11.3 that allows for stored cross-site scripting attacks due to insufficient sanitization of entity suggestions in CKEditor 5.
If you are using Drupal Core version 11.3.0 to 11.3.6, your site is affected by this vulnerability. You can check your version in the admin dashboard or by using the Vulert playground.
The vulnerability can lead to XSS attacks, allowing attackers to execute scripts in the context of another user, potentially compromising user accounts and sensitive data.
Yes, you can restrict access to the CKEditor link suggestion feature for untrusted users as a temporary measure until the patch is applied.
More information can be found in the official Drupal security advisory and on the Vulert website, which monitors open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
