drupal/jsonapi - SA-CONTRIB-2020-010
This module provides a JSON API standards-compliant API for accessing and
manipulating Drupal content and configuration entities.
The security team and module maintainers are marking this project unsupported. Both the 8.x-1.x and 8.x-2.x versions are unsupported, and users of either version are strongly encouraged to upgrade to a supported version of Drupal core, which includes a supported version of JSON:API.
The eventual removal of security coverage for the JSON:API contributed module was announced with the release of JSON:API 8.x-1.22 on 28 June 2018.
Additionally, there is a known security issue with the 8.x-1.x branch of the project that will not be fixed by the maintainers. That issue is not present in the 8.x-2.x branch of the project, nor is it present in Drupal core.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/jsonapi | all versions | no fix |
| Drupal module | drupal/jsonapi | all versions | no fix |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/jsonapi- Disclosed
- 15.04.2020
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2020-010 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/jsonapi
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 02.2018 04.2020
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Unrated 6
Disclosures per year
- 2018: 4
- 2019: 1
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
drupal/jsonapi - SA-CONTRIB-2020-010 this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.