.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

Vulnerability advisory

DRUPAL-CORE-2020-007

Published Sep 16, 2020Updated Sep 19, 2026OSV record ↗

Also known as BIT-drupal-2020-13666CVE-2020-13666GHSA-8jj2-x2gc-ggm7

Severity

Severity not reported.

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`8.0.0` to before 8.8.10	`8.8.10`Advisories →
`8.9.0` to before 8.9.6	`8.9.6`Advisories →
`9.0.0` to before 9.0.6	`9.0.6`Advisories →
Also listed as affected (149) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.3.9` `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.4.6` `8.4.7` `8.4.8` `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1` `8.5.1` `8.5.10` `8.5.11` `8.5.12` `8.5.13` `8.5.14` `8.5.15` `8.5.2` `8.5.3` `8.5.4` `8.5.5` `8.5.6` `8.5.7` `8.5.8` `8.5.9` `8.6.0` `8.6.0-alpha1` `8.6.0-beta1` `8.6.0-beta2` `8.6.0-rc1` `8.6.1` `8.6.10` `8.6.11` `8.6.12` `8.6.13` `8.6.14` `8.6.15` `8.6.16` `8.6.17` `8.6.18` `8.6.2` `8.6.3` `8.6.4` `8.6.5` `8.6.6` `8.6.7` `8.6.8` `8.6.9` `8.7.0` `8.7.0-alpha1` `8.7.0-alpha2` `8.7.0-beta1` `8.7.0-beta2` `8.7.0-rc1` `8.7.1` `8.7.10` `8.7.11` `8.7.12` `8.7.13` `8.7.14` `8.7.2` `8.7.3` `8.7.4` `8.7.5` `8.7.6` `8.7.7` `8.7.8` `8.7.9` `8.8.0` `8.8.0-alpha1` `8.8.0-beta1` `8.8.0-rc1` `8.8.1` `8.8.2` `8.8.3` `8.8.4` `8.8.5` `8.8.6` `8.8.7` `8.8.8` `8.8.9` `8.9.0` `8.9.1` `8.9.2` `8.9.3` `8.9.4` `8.9.5` `9.0.0` `9.0.1` `9.0.2` `9.0.3` `9.0.4` `9.0.5`

Description

The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting.

References

Webwww.drupal.org/sa-core-2020-007 ↗