Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.
The suggestions aren’t sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.
This vulnerability affects the following application versions:
- Drupal 11.3.0
- Drupal 11.3.1
- Drupal 11.3.2
- Drupal 11.3.3
- Drupal 11.3.4
- Drupal 11.3.5
- Drupal 11.3.6