CVE-2025-6674
The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube video embedding into the CKEditor 5 text editor. T...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube video embedding into the CKEditor 5 text editor.
The module doesn't sufficiently validate iframe sources under the scenario where a user embeds a video using the CKEditor YouTube integration leading to a Cross-site Scripting (XSS) vulnerabiity.
This vulnerability is mitigated by the fact that an attacker must have a role with necessary permissions to use CKEditor Youtube embed button.
影響パッケージ
Packagist:https://packages.drupal.org/8
drupal/ckeditor5_youtube
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4"}],"database_specific":{"constraint":"<1.0.4"}}]
参照URL
- web drupal.org