Packagist/drupal/core CVE-2024-12393: unknown, EPSS 0.34%

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized.

Action: Upgrade drupal/core to 10.2.11 or later.

composer require drupal/core:10.2.11

composer require drupal/core:10.3.9

composer require drupal/core:11.0.8

Affected

introduced	fixed	last affected
8.8.0	10.2.11	-
10.3.0	10.3.9	-
11.0.0	11.0.8	-

Fixed versions

10.2.11

10.3.9

11.0.8

Sources

osv: DRUPAL-CORE-2024-003
https://www.drupal.org/sa-core-2024-003

CVE-2024-12393 · published 2024-11-20T17:20:16Z · modified 2026-09-19T18:26:49Z · JSON