| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/entity_browser | < 2.16.0 | 2.16.0 |
| entity browser | < 2.16 | 2.16 |
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget.
The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free