Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

Project: Drupal coreDate: 2026-April-15Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: >= 11.3.0 < 11.3.7CVE IDs: CVE-2026-6367Description: Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.
The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.Solution: Install the latest version:

• If you use Drupal 11.3.x, update to Drupal 11.3.7
• Drupal versions below 11.3 are not affected by this vulnerability

Reported By: 

• cantina_security
• Dries Buytaert (dries)
• Shirsendu Mondal

Fixed By: 

• Lee Rowlands (larowlan) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Mingsong (mingsong), provisional member of the Drupal Security Team

Coordinated By: 

• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team