DRUPAL-CONTRIB-2020-002

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/spamspan/DRUPAL-CONTRIB-2020-002.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2020-002
Published
2020-01-22T17:36:50Z
Modified
2025-12-10T23:32:00.825192Z
Summary
[none]
Details

The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them.

This module contains a spamspan twig filter which doesn't sanitize the passed HTML string.

This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/spamspan

Package

Name
drupal/spamspan
Purl
pkg:composer/drupal/spamspan

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0
Last affected
1.0.0
Database specific 
{
    "constraint": "1.0.0"
}

Database specific

affected_versions 
"1.0.0"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/spamspan/DRUPAL-CONTRIB-2020-002.json"