Back to Codebase

Vulnerability Analysis Report

Drupal Core v9.2.1

Scan ID: SCAN-DRUPAL-CORE-PVFyNb • Hash: b197ffde

Severity Score
High
Total Findings
5
Engine Version
ECOMGUARD-HYBRID-AST-1.5
Scan Duration
1.089s

Vulnerability Details

L97

Insecure DOM Manipulation (XSS) in ckeditor.js

CWE-79
File Location: core/assets/vendor/ckeditor/ckeditor.js:97
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- c=new CKEDITOR.dom.element("body",this.getDocument());c.$.innerHTML=a;for(c=c.getChildren();c.count();)this.append(c.getItem(0));return a}}:function(a){return this.$.innerHTML=a},setText:function(){var a=document.createElement("p");a.innerHTML="x";a=a.textContent;return function(c){this.$[a?"textContent":"innerText"]=c}}(),getAttribute:function(){var a=function(c){return this.$.getAttribute(c,2)};return CKEDITOR.env.ie&&(CKEDITOR.env.ie7Compat||CKEDITOR.env.quirks)?function(c){switch(c){case "class":c=
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L814

Insecure DOM Manipulation (XSS) in ckeditor.js

CWE-79
File Location: core/assets/vendor/ckeditor/ckeditor.js:814
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- shy:"­",gt:"\x3e",lt:"\x3c",amp:"\x26",apos:"'",quot:'"'};b=b.replace(/\b(nbsp|shy|gt|lt|amp|apos|quot)(?:,|$)/g,function(c,b){var h=g?"\x26"+b+";":k[b];f[h]=g?k[b]:"\x26"+b+";";a.push(h);return""});b=b.replace(/,$/,"");if(!g&&b){b=b.split(",");var l=document.createElement("div"),m;l.innerHTML="\x26"+b.join(";\x26")+";";m=l.innerHTML;l=null;for(l=0;l<m.length;l++){var c=m.charAt(l);f[c]="\x26"+b[l]+";";a.push(c)}}f.regex=a.join(g?"|":"");return f}CKEDITOR.plugins.add("entities",{afterInit:function(h){function g(a){return c[a]}
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L530

Insecure DOM Manipulation (XSS) in ckeditor.js

CWE-79
File Location: core/assets/vendor/ckeditor/ckeditor.js:530
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- g,h;if(CKEDITOR.env.webkit)for(c=c.split("}").slice(0,-1),g=0;g<c.length;g++)c[g]=c[g].split("{");for(var k=0;k<a.length;k++)if(CKEDITOR.env.webkit)for(g=0;g<c.length;g++){h=c[g][1];for(f=0;f<b.length;f++)h=h.replace(b[f][0],b[f][1]);a[k].$.sheet.addRule(c[g][0],h)}else{h=c;for(f=0;f<b.length;f++)h=h.replace(b[f][0],b[f][1]);CKEDITOR.env.ie&&11>CKEDITOR.env.version?a[k].$.styleSheet.cssText+=h:a[k].$.innerHTML+=h}}var k={};CKEDITOR.skin={path:b,loadPart:function(a,c){CKEDITOR.skin.name!=CKEDITOR.skinName.split(",")[0]?
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1389

Insecure DOM Manipulation (XSS) in jquery.js

CWE-79
File Location: core/assets/vendor/jquery/jquery.js:1389
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- el.innerHTML = "<a href='' disabled='disabled'></a>" +
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L34

Insecure DOM Manipulation (XSS) in shepherd.min.js

CWE-79
File Location: core/assets/vendor/shepherd/shepherd.min.js:34
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- a[5];e||(f=oa(b,"click",function(){bb(a[0])&&a[0].apply(this,arguments)}),e=!0)},p(e,[f]){a=e;f&32&&(b.innerHTML=a[5]);f&8&&c!==(c=a[3]?a[3]:null)&&q(b,"aria-label",c);f&18&&d!==(d=`${a[1]||""} shepherd-button ${a[4]?"shepherd-button-secondary":""}`)&&q(b,"class",d);f&4&&(b.disabled=a[2])},i:x,o:x,d(a){a&&w(b);e=!1;f()}}}function Rb(a,b,c){let {config:d}=b,{step:e}=b,f,h,k,m,g,l;a.$$set=a=>{"config"in a&&c(6,d=a.config);"step"in a&&c(7,e=a.step)};a.$$.update=()=>{if(a.$$.dirty&192){c(0,f=d.action?
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output