Critical XSS Vulnerability in CKEditor Used by Drupal Core - Update Required
Summary
DRUPAL-CORE-2026-013: The Drupal project uses the CKEditor library for WYSIWYG editing. Affects drupal/core across 3 version ranges.
>= 10.5.0, < 10.6.17
>= 11.0.0, < 11.3.17
>= 11.4.0, < 11.4.7
Fixed in 10.6.17, 11.3.17 or 11.4.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is a widely-used open-source content management system (CMS) that allows users to create and manage websites. It employs the CKEditor library for WYSIWYG (What You See Is What You Get) editing, enabling users to format text and insert multimedia content seamlessly. However, recent security findings have revealed vulnerabilities in CKEditor that could compromise the security of Drupal sites, particularly those allowing user-generated content.
Vulnerability Detail
The vulnerability stems from a Cross-Site Scripting (XSS) flaw in the CKEditor library, which can be exploited by attackers who can create or edit content. Even users without direct access to CKEditor can potentially trigger this vulnerability, targeting users with access to the WYSIWYG editor, including site administrators. This could lead to unauthorized actions being executed in the context of the affected user's session, posing significant risks to site integrity and user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.5.0, < 10.6.1710.6.17composer require drupal/core:10.6.17 -
>= 11.0.0, < 11.3.1711.3.17composer require drupal/core:11.3.17 -
>= 11.4.0, < 11.4.711.4.7composer require drupal/core:11.4.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider disabling CKEditor for user-generated content or restricting access to the WYSIWYG editor for untrusted users until the update can be applied.
Conclusion
The XSS vulnerability in CKEditor poses a significant risk to Drupal sites that utilize this library for content editing. It is essential to update to the latest patched versions of Drupal core to mitigate this risk. Additionally, users should consider temporary workarounds to protect their sites until updates can be applied.
See every vulnerability recorded for drupal/core →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) issue in the CKEditor library used by Drupal, allowing attackers to execute scripts in the context of users' sessions.
Any Drupal site using CKEditor for WYSIWYG editing is potentially affected, especially if it allows user-generated content.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, consider disabling CKEditor for user-generated content or limiting access to the WYSIWYG editor for untrusted users.
For more details, refer to CKEditor's security advisory at https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
