GHSA-pw6f-3999-xp7gmedium6.1
Drupal core allows Cross-Site Scripting (XSS)
The advisory, in context
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 11.3.0 before 11.3.7.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/core Packagist
Ecosystem versions
From 11.3.0 before 11.3.7
Fixed in 11.3.7
7 explicitly affected versions
11.3.0, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "11.3.0"
},
{
"fixed": "11.3.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.3.0",
"11.3.1",
"11.3.2",
"11.3.3",
"11.3.4",
"11.3.5",
"11.3.6"
]
}