| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 7.0.0, < 7.80≥ 8.0.0, < 8.9.16≥ 9.0.0, < 9.0.14≥ 9.1.0, < 9.1.9 | 7.808.9.169.0.149.1.9 |
| drupal/drupal | ≥ 7.0.0, < 7.80≥ 8.0.0, < 8.9.16≥ 9.0.0, < 9.0.14≥ 9.1.0, < 9.1.9 | 7.808.9.169.0.149.1.9 |
| ckeditor | ≥ 4.14.0, < 4.16.1 | 4.16.1 |
| drupal | ≥ 8.9.0, < 8.9.16≥ 9.0.0, < 9.0.14≥ 9.1.0, < 9.1.9 | 8.9.169.0.149.1.9 |
| ckeditor4 | ≥ 4.14.0, < 4.16.1 | 4.16.1 |
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free