Packagist/drupal/core CVE-2018-9861: unknown, EPSS 1.72%

CKEditor, a third-party JavaScript library included in Drupal core, has [fixed a cross-site scripting (XSS) vulnerability](https://ckeditor.com/blog/CKEditor-4.9.2-with-a-security-patch-released/). Th

Action: Upgrade drupal/core to 8.4.7 or later.

composer require drupal/core:8.4.7

composer require drupal/core:8.5.2

Affected

introduced	fixed	last affected
8.0.0	8.4.7	-
8.5.0	8.5.2	-

Fixed versions

8.4.7

8.5.2

Sources

osv: DRUPAL-CORE-2018-003
https://www.drupal.org/sa-core-2018-003

CVE-2018-9861 · published 2018-04-18T15:34:09Z · modified 2025-12-10T23:41:15.971028Z · JSON