Packagist/drupal/core CVE-2020-13673: unknown, EPSS 0.26%

The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is

Action: Upgrade drupal/core to 8.9.19 or later.

composer require drupal/core:8.9.19

composer require drupal/core:9.1.13

composer require drupal/core:9.2.6

Affected

introduced	fixed	last affected
8.0.0	8.9.19	-
9.1.0	9.1.13	-
9.2.0	9.2.6	-

Fixed versions

8.9.19

9.1.13

9.2.6

Sources

osv: DRUPAL-CORE-2021-006
https://www.drupal.org/sa-core-2021-006

CVE-2020-13673 · published 2021-09-15T15:18:26Z · modified 2026-09-19T16:54:45Z · JSON