[Security-news] CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-081

Project: CKEditor5 Youtube [1]
Date: 2025-June-25
Security risk: *Moderately critical* 14 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross-site Scripting

Affected versions: <1.0.3
CVE IDs: CVE-2025-6674
Description: 
The CKEditor5 Youtube module enhances content creation in Drupal by
seamlessly integrating YouTube video embedding into the CKEditor 5 text
editor.

The module doesn't sufficiently validate iframe sources under the scenario
where a user embeds a video using the CKEditor YouTube integration leading to
a Cross-site Scripting (XSS) vulnerabiity.
This vulnerability is mitigated by the fact that an attacker must have a role
with necessary permissions to use CKEditor Youtube embed button.

Solution: 
Install the latest version:

  * If you are using the CKEditor5 YouTube module on Drupal 9.x or higher, you
    should upgrade to: CKEditor5 Youtube 1.0.3 [3]

Reported By: 
  * nico.b [4]

Fixed By: 
  * Brahim Khouy (b.khouy) [5]
  * Abderrahim GHAZALI 🤘 (g.abderrahim) [6]
  * nico.b [7]

Coordinated By: 
  * Greg Knaddison (greggles) [8] of the Drupal Security Team


[1] https://www.drupal.org/project/ckeditor5_youtube
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ckeditor5_youtube/releases/1.0.3
[4] https://www.drupal.org/u/nicob
[5] https://www.drupal.org/u/bkhouy
[6] https://www.drupal.org/u/gabderrahim
[7] https://www.drupal.org/u/nicob
[8] https://www.drupal.org/u/greggles