Today, there is a Critical security release for Drupal core to fix a Cross-Site Scripting (XSS) vulnerability. You can learn more in the security advisory:
Drupal core – Critical – Cross-Site Scripting – SA-CORE-2021-002
Here you can download the Drupal 6 patch to fix, or a full release ZIP or TAR.GZ.
If you have a Drupal 6 site, we recommend you update immediately! We have already deployed the patch for all of our Drupal 6 Long-Term Support clients. 🙂
FYI, there were other Drupal core security advisories made today, but those don’t affect Drupal 6.
If you’d like all your Drupal 6 modules to receive security updates and have the fixes deployed the same day they’re released, please check out our D6LTS plans.
Note: if you use the myDropWizard module (totally free!), you’ll be alerted to these and any future security updates, and will be able to use drush to install them (even though they won’t necessarily have a release on Drupal.org).
Go to Source