Back to Codebase

Vulnerability Analysis Report

Drupal Core v9.3.0-alpha1

Scan ID: SCAN-DRUPAL-CORE-HrEpDM • Hash: 70feb62b

Severity Score
High
Total Findings
5
Engine Version
ECOMGUARD-HYBRID-AST-1.5
Scan Duration
1.065s

Vulnerability Details

L6333

Insecure DOM Manipulation (XSS) in jquery.js

CWE-79
File Location: core/assets/vendor/jquery/jquery.js:6333
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- elem.innerHTML = value;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L531

Insecure DOM Manipulation (XSS) in ckeditor.js

CWE-79
File Location: core/assets/vendor/ckeditor/ckeditor.js:531
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- f,h;if(CKEDITOR.env.webkit)for(c=c.split("}").slice(0,-1),f=0;f<c.length;f++)c[f]=c[f].split("{");for(var k=0;k<a.length;k++)if(CKEDITOR.env.webkit)for(f=0;f<c.length;f++){h=c[f][1];for(e=0;e<b.length;e++)h=h.replace(b[e][0],b[e][1]);a[k].$.sheet.addRule(c[f][0],h)}else{h=c;for(e=0;e<b.length;e++)h=h.replace(b[e][0],b[e][1]);CKEDITOR.env.ie&&11>CKEDITOR.env.version?a[k].$.styleSheet.cssText+=h:a[k].$.innerHTML+=h}}var m={};CKEDITOR.skin={path:b,loadPart:function(a,c){CKEDITOR.skin.name!=CKEDITOR.skinName.split(",")[0]?
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L792

Insecure DOM Manipulation (XSS) in jquery.form.js

CWE-79
File Location: core/assets/vendor/jquery-form/src/jquery.form.js:792
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- xhr.responseText = docRoot ? docRoot.innerHTML : null;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L10301

Insecure DOM Manipulation (XSS) in jquery.js

CWE-79
File Location: core/assets/vendor/jquery/jquery.js:10301
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- body.innerHTML = "<form></form><form></form>";
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L97

Insecure DOM Manipulation (XSS) in ckeditor.js

CWE-79
File Location: core/assets/vendor/ckeditor/ckeditor.js:97
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- (c.height=c.bottom-c.top);return a?CKEDITOR.tools.getAbsoluteRectPosition(this.getWindow(),c):c},setHtml:CKEDITOR.env.ie&&9>CKEDITOR.env.version?function(a){try{var c=this.$;if(this.getParent())return c.innerHTML=a;var d=this.getDocument()._getHtml5ShivFrag();d.appendChild(c);c.innerHTML=a;d.removeChild(c);return a}catch(g){this.$.innerHTML="";c=new CKEDITOR.dom.element("body",this.getDocument());c.$.innerHTML=a;for(c=c.getChildren();c.count();)this.append(c.getItem(0));return a}}:function(a){return this.$.innerHTML=
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output