Vulnerability advisory

DRUPAL-CORE-2026-003

Published Apr 15, 2026Updated Sep 10, 2026OSV record ↗

Severity

Severity not reported.

Affected versions

Affected	Fixed in
`11.3.0` to before 11.3.7	`11.3.7`Advisories →
Also listed as affected (7) `11.3.0` `11.3.1` `11.3.2` `11.3.3` `11.3.4` `11.3.5` `11.3.6`

Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.

The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.