DRUPAL-CONTRIB-2021-042
Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field.
It does not sufficiently sanitize user input.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit an entity bundle.
What each source reports
OSVNo score
Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field.
It does not sufficiently sanitize user input.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit an entity bundle.
- Record
DRUPAL-CONTRIB-2021-042- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/linkitPackagist:https://packages.drupal.org/8 | before 4.4.0 | 4.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2021-042 is a vulnerability with no CVSS score yet in drupal/linkit, published September 29, 2021. No source lists public exploit code. Fixed in drupal/linkit 4.4.0.