| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 8.0.0, < 8.9.19≥ 9.1.0, < 9.1.13≥ 9.2.0, < 9.2.6 | 8.9.199.1.139.2.6 |
| drupal/entity_embed | < 1.2.0 | 1.2.0 |
| entity embed | = 8.x-1.0= 8.x-1.1= 8.x-1.2 |
This advisory addresses a similar issue to Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006.
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free