{"action":"Upgrade ckeditor-dev to 4.9.2 or later.","affected":[{"fixed":"4.9.2","introduced":"4.5.10"}],"component":"ckeditor-dev","cve_ids":["CVE-2018-9861"],"ecosystem":"npm","epss":0.01719,"exploited":false,"fixed_versions":["4.9.2"],"ghsa_id":"GHSA-g78h-pf65-46rv","id":"tcs_01M5KF2E83E3B88TCVJSYY58QT","modified_at":"2025-12-10T23:41:15.971028Z","published_at":"2022-05-14T00:56:02Z","references":["https://osv.dev/vulnerability/GHSA-g78h-pf65-46rv","https://nvd.nist.gov/vuln/detail/CVE-2018-9861","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-9861.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-9861.yaml","https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md","https://www.drupal.org/sa-core-2018-003","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.securityfocus.com/bid/103924"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-g78h-pf65-46rv#npm/ckeditor-dev","url":"https://osv.dev/vulnerability/GHSA-g78h-pf65-46rv"}],"summary":"Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)"}