—
DRUPAL-CORE-2020-007
Quick fix
DRUPAL-CORE-2020-007 — drupal/core: upgrade to the fixed version with the command below.
composer require drupal/core:^8.8.10Details
The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting.
Are you affected?
Enter the version of the package you're using.