Cross-site scripting in Drupal CKEditor 4 LTS - WYSIWYG HTML editor

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.

• The Drupal ckeditor_lts module, described as CKEditor 4 LTS - WYSIWYG HTML editor, is affected from 1.0.0 before 1.0.1.
• For Drupal 9.4+ deployments, the Drupal advisory directs users to upgrade ckeditor_lts to 1.0.1.
• The available evidence does not establish additional affected branches or the status of other deployment branches. Do not infer that every later or parallel release is unaffected solely from the documented fix guidance.

This is a CWE-79 weakness in which input handled during web page generation is not properly neutralized, resulting in Cross-Site Scripting (XSS). The Drupal advisory attributes the condition to incorrect CDATA detection in the CKEditor library and states that it may affect the Drupal module that bundles and integrates that code. Exposure requires either full-page editing mode to be enabled or CDATA elements to be enabled in the Advanced Content Filtering configuration, which defaults to script and style elements. The attacker must also have a permission that provides access to the CKEditor instance. The available evidence does not describe the exact parser, sanitization path, or payload format.

The flaw is reachable through the web application over the network rather than being limited to local access. The attacker requires low-level privileges or an account with permission to access the CKEditor instance. The recorded attack complexity is low, but user interaction is required for the affected content to be processed or displayed. Exploitation also depends on full-page editing or CDATA elements being enabled in Advanced Content Filtering. The normalized record marks public exploit as false, but the current real-world exploitation status is not established.

Successful exploitation could execute attacker-controlled script in a user's browser within the Drupal site's context. Depending on the victim's permissions and the page content, the script could access information available to that user or affect content and actions within that browser context. The supplied assessment supports limited confidentiality and integrity consequences but does not identify an availability consequence. The available advisory does not describe server-side code execution, privilege escalation, or direct database access.

An attacker with access to the CKEditor instance may submit content that causes script execution in a user's browser when the content is processed or displayed.

• Depending on the victim's permissions, the result could expose data available to that user or alter content and actions within the affected browser context.
• Response work may require reviewing editor permissions, configuration, and content changes across multiple sites.
• The available evidence does not establish data exfiltration, account takeover, server compromise, or service outage.

1. For Drupal 9.4+ deployments, upgrade ckeditor_lts to 1.0.1, the fixed release named by the Drupal advisory.
2. Inventory the actual module version across all sites and address every deployment from 1.0.0 before 1.0.1.
3. If an immediate upgrade is not possible, review full-page editing, CDATA elements in Advanced Content Filtering, and permissions that provide access to the CKEditor instance. These conditions may be restricted as temporary risk reduction, but the Drupal source does not present that configuration change as a complete replacement for upgrading.
4. After updating, recheck editor configuration, role permissions, and content creation or editing workflows that use CKEditor.

1. Inventory Drupal sites and identify deployments that install the ckeditor_lts module.
2. Check the module version against the affected boundary in affected_summary, rather than relying only on the Drupal core version.
3. Review CKEditor settings to determine whether full-page editing is enabled and whether Advanced Content Filtering permits CDATA elements, especially script or style.
4. Review roles and permissions to identify accounts that can access the CKEditor instance.
5. As a precaution, review application logs, content revision history, and browser security telemetry for unusual activity involving editor content. This is a precautionary review, not a known indicator, because the available sources provide no specific IOC or log event. The absence of suspicious logs does not prove that a deployment is safe.