DRUPAL-CONTRIB-2022-042
The Drupal Embed module provides a filter to allow embedding various embeddable items like entities in content fields.
In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed items. In some cases, this could lead to Cross-Site Request Forgery.
What each source reports
OSV No score
The Drupal Embed module provides a filter to allow embedding various embeddable items like entities in content fields.
In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed items. In some cases, this could lead to Cross-Site Request Forgery.
- Record
DRUPAL-CONTRIB-2022-042- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/embedPackagist:https://packages.drupal.org/8 |
before 1.5.0 | 1.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2022-042 is a vulnerability with no CVSS score yet in drupal/embed, published May 25, 2022. No source lists public exploit code. Fixed in drupal/embed 1.5.0.