Vulnerability advisory

DRUPAL-CORE-2021-003

Published May 26, 2021Updated Sep 19, 2026OSV record ↗

Also known as BIT-drupal-2021-33829CVE-2021-33829GHSA-rgx6-rjj4-c388

Severity

Severity not reported.

Affected versions

drupal/core Packagist

Affected	Fixed in
`8.0.0` to before 8.9.16	`8.9.16`Advisories →
`9.0.0` to before 9.0.14	`9.0.14`Advisories →
`9.1.0` to before 9.1.9	`9.1.9`Advisories →
Also listed as affected (183) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.3.9` `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.4.6` `8.4.7` `8.4.8` `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1` `8.5.1` `8.5.10` `8.5.11` `8.5.12` `8.5.13` `8.5.14` `8.5.15` `8.5.2` `8.5.3` `8.5.4` `8.5.5` `8.5.6` `8.5.7` `8.5.8` `8.5.9` `8.6.0` `8.6.0-alpha1` `8.6.0-beta1` `8.6.0-beta2` `8.6.0-rc1` `8.6.1` `8.6.10` `8.6.11` `8.6.12` `8.6.13` `8.6.14` `8.6.15` `8.6.16` `8.6.17` `8.6.18` `8.6.2` `8.6.3` `8.6.4` `8.6.5` `8.6.6` `8.6.7` `8.6.8` `8.6.9` `8.7.0` `8.7.0-alpha1` `8.7.0-alpha2` `8.7.0-beta1` `8.7.0-beta2` `8.7.0-rc1` `8.7.1` `8.7.10` `8.7.11` `8.7.12` `8.7.13` `8.7.14` `8.7.2` `8.7.3` `8.7.4` `8.7.5` `8.7.6` `8.7.7` `8.7.8` `8.7.9` `8.8.0` `8.8.0-alpha1` `8.8.0-beta1` `8.8.0-rc1` `8.8.1` `8.8.10` `8.8.11` `8.8.12` `8.8.2` `8.8.3` `8.8.4` `8.8.5` `8.8.6` `8.8.7` `8.8.8` `8.8.9` `8.9.0` `8.9.0-beta1` `8.9.0-beta2` `8.9.0-beta3` `8.9.0-rc1` `8.9.1` `8.9.10` `8.9.11` `8.9.12` `8.9.13` `8.9.14` `8.9.15` `8.9.2` `8.9.3` `8.9.4` `8.9.5` `8.9.6` `8.9.7` `8.9.8` `8.9.9` `9.0.0` `9.0.1` `9.0.10` `9.0.11` `9.0.12` `9.0.13` `9.0.2` `9.0.3` `9.0.4` `9.0.5` `9.0.6` `9.0.7` `9.0.8` `9.0.9` `9.1.0` `9.1.1` `9.1.2` `9.1.3` `9.1.4` `9.1.5` `9.1.6` `9.1.7` `9.1.8`

Description

Update: 2021-06-11: Added CVE-2021-33829 identifier

Drupal core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to an XSS attack. CKEditor 4.16.1 and later include the fix.

Update: 2021-06-11: More details are available on CKEditor's blog.

Users of the CKEditor library via means other than Drupal core should update their 3rd party code (e.g. the WYSIWYG module for Drupal 7). The Drupal Security Team policy is not to alert for issues affecting 3rd party libraries unless those are shipped with Drupal core. See DRUPAL-SA-PSA-2016-004 for more details.

This issue is mitigated by the fact that it only affects sites with CKEditor enabled.

References

Webwww.drupal.org/sa-core-2021-003 ↗