GHSA-8mvq-8h2v-j9vfMediumCVSS 5.4

Drupal Core Cross-Site Scripting (XSS)

Published
December 10, 2024
Last Modified
June 4, 2025

🔗 CVE IDs covered (1)

CVE-2024-12393 →

📋 Description

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

🎯 Affected products9

  • composer/drupal/core:>= 8.8.0, < 10.2.11
  • composer/drupal/core:>= 10.3.0, < 10.3.9
  • composer/drupal/core:>= 11.0.0, < 11.0.8
  • composer/drupal/core-recommended:>= 8.8.0, < 10.2.11
  • composer/drupal/core-recommended:>= 10.3.0, < 10.3.9
  • composer/drupal/core-recommended:>= 11.0.0, < 11.0.8
  • composer/drupal/drupal:>= 8.8.0, < 10.2.11
  • composer/drupal/drupal:>= 10.3.0, < 10.3.9
  • composer/drupal/drupal:>= 11.0.0, < 11.0.8

🔗 References (4)