CVE-2025-6674

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3.

Reserved 2025-06-25 | Published 2025-06-26 | Updated 2025-06-26 | Assigner drupal

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
unaffected

0.0.0 before 1.0.4
affected

Credits

nico.b finder

Brahim Khouy (b.khouy) remediation developer

Abderrahim GHAZALI 🤘 (g.abderrahim) remediation developer

nico.b remediation developer

Greg Knaddison (greggles) coordinator

References

www.drupal.org/sa-contrib-2025-081

cve.org (CVE-2025-6674)

nvd.nist.gov (CVE-2025-6674)

Download JSON