Medium severity6.1NVD Advisory· Published Mar 1, 2018· Updated Jun 17, 2026
CVE-2017-6927
CVE-2017-6927
Description
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
drupal/corePackagist | >= 8.4.0, < 8.4.5 | 8.4.5 |
drupal/corePackagist | >= 7.0, < 7.57 | 7.57 |
drupal/drupalPackagist | >= 8.4.0, < 8.4.5 | 8.4.5 |
drupal/drupalPackagist | >= 7.0, < 7.57 | 7.57 |
Affected products
7- ghsa-coords2 versions
>= 8.4.0, < 8.4.5+ 1 more
- (no CPE)range: >= 8.4.0, < 8.4.5
- (no CPE)range: >= 8.4.0, < 8.4.5
- Range: 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57
Patches
Vulnerability mechanics
References
8- www.securityfocus.com/bid/103138nvdThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-585j-5449-mf5mghsaADVISORY
- lists.debian.org/debian-lts-announce/2018/02/msg00030.htmlnvdMailing ListThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2017-6927ghsaADVISORY
- www.debian.org/security/2018/dsa-4123nvdThird Party AdvisoryWEB
- www.drupal.org/sa-core-2018-001nvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yamlghsaWEB
News mentions
0No linked articles in our index yet.