{"action":"Upgrade drupal/core to 8.4.7 or later.","affected":[{"fixed":"8.4.7","introduced":"8.0.0"},{"fixed":"8.5.2","introduced":"8.5.0"}],"component":"drupal/core","cve_ids":["CVE-2018-9861"],"ecosystem":"Packagist","epss":0.01719,"exploited":false,"fixed_versions":["8.4.7","8.5.2"],"ghsa_id":"GHSA-g78h-pf65-46rv","id":"tcs_01M5KER71P6DFAPFK477E75HRN","modified_at":"2025-12-10T23:41:15.971028Z","published_at":"2018-04-18T15:34:09Z","references":["https://osv.dev/vulnerability/DRUPAL-CORE-2018-003","https://www.drupal.org/sa-core-2018-003"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CORE-2018-003","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2018-003"}],"summary":"CKEditor, a third-party JavaScript library included in Drupal core, has [fixed a cross-site scripting (XSS) vulnerability](https://ckeditor.com/blog/CKEditor-4.9.2-with-a-security-patch-released/). Th"}