CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

• CWE-352
• CWE-79

• https://www.drupal.org/sa-contrib-2021-028Patch, Vendor Advisory
• https://www.drupal.org/sa-contrib-2021-028Patch, Vendor Advisory

Published

Feb 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13668Access Bypass vulnerability in Drupal Core allows for an att…6.1
• CVE-2020-13669Cross-site Scripting (XSS) vulnerability in ckeditor of Drup…6.1
• CVE-2020-1367An information disclosure vulnerability exists when the Wind…5.5
• CVE-2020-13670Information Disclosure vulnerability in file module of Drupa…7.5
• CVE-2020-13671Drupal core does not properly sanitize certain filenames on …8.8
• CVE-2020-13672Cross-site Scripting (XSS) vulnerability in Drupal core's sa…6.1
• CVE-2020-13674The QuickEdit module does not properly validate access to ro…6.5
• CVE-2020-13675Drupal's JSON:API and REST/File modules allow file uploads t…9.8
• CVE-2020-13676The QuickEdit module does not properly check access to field…6.5
• CVE-2020-13677Under some circumstances, the Drupal core JSON:API module do…7.5
• CVE-2020-1368An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-13688Cross-site scripting vulnerability in l Drupal Core allows a…6.1