Description
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal.org | Drupal Core | 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | drupal7 | 7.52-2+deb9u2 | DSA-4123-1 |
| Debian 8 | drupal7 | 7.32-1+deb8u10 | DSA-4123-1 |
| Debian 7 | drupal7 | 7.14-2+deb7u17 | DLA-1295-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | drupal7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | drupal7 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.4.0, < 8.4.5 | 8.4.5 | GHSA-585j-5449-mf5m |
| Packagist | drupal/core | >= 7.0, < 7.57 | 7.57 | GHSA-585j-5449-mf5m |
| Packagist | drupal/drupal | >= 8.4.0, < 8.4.5 | 8.4.5 | GHSA-585j-5449-mf5m |
| Packagist | drupal/drupal | >= 7.0, < 7.57 | 7.57 | GHSA-585j-5449-mf5m |
Advisories 2
- DSA-4123-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1295-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-4123 vendor-advisory
- [debian-lts-announce] 20180228 [SECURITY] [DLA 1295-1] drupal7 security update mailing-list
- 103138 vdb-entry
- https://www.drupal.org/sa-core-2018-001