DRUPAL-CONTRIB-2026-314

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/htmlawed/DRUPAL-CONTRIB-2026-314.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-314
Aliases
  • CVE-2026-122080
Published
2026-11-04T17:52:30Z
Modified
2026-11-04T20:30:02Z
Summary
[none]
Details

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.

The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.

Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/htmlawed

Package

Name
drupal/htmlawed
Purl
pkg:composer/drupal/htmlawed?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.9.0
Database specific
Show details 
{
    "constraint": ">=3.0.0 <3.9.0"
}
Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.1.8
Database specific
Show details 
{
    "constraint": ">=4.0.0 <4.1.8"
}

Database specific

affected_versions 
">=3.0.0 <3.9.0 || >=4.0.0 <4.1.8"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/htmlawed/DRUPAL-CONTRIB-2026-314.json"