CVE-2020-13673
EPSS 0.15%Published: 9/15/2021Modified: 12/10/2025
Also known as:DRUPAL-CONTRIB-2021-028DRUPAL-CORE-2021-006
Description
The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting. This advisory is not covered by [Drupal Steward](/steward). Also see [Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028](https://www.drupal.org/sa-contrib-2021-028) which addresses a similar vulnerability for that module. *Updated 18:15 UTC to clarify text.*
Affected packages (2)
- Packagist/drupal/core>= 8.0.0, < 8.9.19 | >= 9.1.0, < 9.1.13 | >= 9.2.0, < 9.2.6
- Packagist/drupal/entity_embedfrom 0, < 1.2.0