The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Update from 4.13.1 to 4.14.
4.14 was released the day after Drupal 8.8.3 shipped: https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-rele...
CKEditor 4.14 adds support from pasting from LibreOffice, fixes two XSS vulnerabilities of which only one affects our CKEditor build (and fortunately it is very obscure, but sadly we didn't get advance notice nor coordination with the Drupal Security Team — presumably because of the obscurity). There are also significant Widget system improvements that allows us to finally fix #3064572: Add mask to prevent interaction with embedded media!
See also:
#1858210: [meta] Content editing experience follow-ups — in-place editing and WYSIWYG
#1950098: Update CKEditor library to 4.1
#2036253: Update CKEditor library to 4.2
#2039163: Update CKEditor library to 4.4
#2271051: Update CKEditor library to 4.4.4
#2345961: Update CKEditor library to 4.4.5
#2384581: Security: Update CKEditor library to 4.4.6
#2415111: Update CKEditor library to 4.4.7
#2521820: Update CKEditor library to 4.5.3
#2321583: Update CKEditor library to 4.5.5
#2663566: Update CKEditor library to 4.5.7
#2698587: Update CKEditor library to 4.5.8
#2724225: Update CKEditor library to 4.5.9
#2765751: Update CKEditor library to 4.5.10
#2797427: Update CKEditor library to 4.5.11
#2828494: Update CKEditor library to 4.6
#2848215: Update CKEditor library to 4.6.2
#2893566: Update CKEditor library to 4.7.1
#2904142: Update CKEditor library to 4.7.2
#2908864: Update CKEditor library to 4.7.3
#2926932: Update CKEditor library to 4.8.0
#2962330: Update CKEditor library to 4.9.2
#2983516: Update CKEditor library to 4.10.0
#2999691: Update CKEditor library to 4.10.1
#3035933: Update CKEditor to 4.11.3
#3050757: Update CKEditor to 4.11.4
#3072382: Update CKEditor to version 4.13
#3105327: Update CKEditor to version 4.13.1
Release notes snippet
CKEditor has been updated from from 4.13.1 to 4.14, which includes numerous bugfixes and improvements.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | 3120022-7--8.7.x.patch | 3.52 MB | lauriii |
| #5 | interdiff.txt | 594 bytes | lauriii |
| #5 | 3120022-5.patch | 1.78 MB | lauriii |
| #4 | 3120022-4.patch | 1.78 MB | lauriii |
Comments
Comment #2
catchComment #3
lauriiiComment #4
lauriiiComment #5
lauriiiUpdated core.libraries.yml too.
I did some manual testing. I tested Quickedit, CKEditor config form and CKEditor image, media library and link integrations. I didn't see any regressions.
Comment #6
wim leersThe CKEditor team shared an exploit with me. I can confirm that this patch fixes the security vulnerability.
I also did manual testing of Quick Edit, the CKEditor configuration UI, CKEditor image, CKEditor media library. Also couldn't find any regressions. The patch in #5 applies to
8.8.x,8.9.xand9.0.x, and should be committed to all three branches.This will also need a patch for the
8.7.xbranch, and we'll need to repeat manual testing. Marking NW for that, otherwise this would've been RTBC.Comment #7
lauriiiHere's patch for 8.7.x. I took the same steps as with #5 to manually test this with 8.7.x.
Comment #8
wim leersComment #9
pandaski commentedThanks for the patches.
How can we contribute to the test process?
Comment #10
wim leersThis already shipped yesterday in Drupal 8.7.12 and 8.8.4: https://www.drupal.org/sa-core-2020-001. This is now only for 8.9 and 9.0
Comment #11
wim leers@pandaski The highly unusual circumstances here (CKEditor security release shipped some time ago, without coordination with the Drupal security team) explain why this issue was public instead of private. Our hand was forced. We've worked with the CKEditor team to ensure this does not happen again. Security releases are extremely rare for them, which explains why they're not used to coordinating.
Comment #12
catchthis was cherry-picked by xjm to 9.0.x in 05ab1e26be420
And to 8.9.x in 5f269c656e9b3644
So we should be good to mark this fixed.