Skip to content
Fencer Intel
no cvss —

DRUPAL-CORE-2026-013 json

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing.

published last mo. modified last mo.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security update that impacts Drupal](https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp).

Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

For more information, see CKEditor's security advisory:

* [High-severity Cross-site scripting (XSS) in the engine package](https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp)

Patch / fix

  • packagist drupal/core 10.6.17, 11.3.17, 11.4.7

Is DRUPAL-CORE-2026-013 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist drupal/core
>=10.5.0, <10.6.17
>=11.0.0, <11.3.17
>=11.4.0, <11.4.7
10.6.17
11.3.17
11.4.7

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.