Packagist/drupal/core CVE-2020-13672: unknown, EPSS 0.68%

Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances.

Action: Upgrade drupal/core to 8.9.14 or later.

composer require drupal/core:8.9.14

composer require drupal/core:9.0.12

composer require drupal/core:9.1.7

Affected

Fixed versions

Sources

• osv: DRUPAL-CORE-2021-002
• https://www.drupal.org/sa-core-2021-002

CVE-2020-13672 · published 2021-04-21T15:58:22Z · modified 2026-09-19T17:43:24Z · JSON