Packagist/drupal/core CVE-2020-13666: unknown, EPSS 2.93%

The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting.

Action: Upgrade drupal/core to 8.8.10 or later.

composer require drupal/core:8.8.10

composer require drupal/core:8.9.6

composer require drupal/core:9.0.6

Affected

Fixed versions

Sources

• osv: DRUPAL-CORE-2020-007
• https://www.drupal.org/sa-core-2020-007

CVE-2020-13666 · published 2020-09-16T15:48:49Z · modified 2026-09-19T17:33:14Z · JSON