DRUPAL-CONTRIB-2026-315

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/htmlawed/DRUPAL-CONTRIB-2026-315.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-315
Aliases
  • CVE-2026-122079
Published
2026-11-04T17:52:43Z
Modified
2026-11-04T20:30:03Z
Summary
[none]
Details

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.

The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting (XSS) vulnerability.

This vulnerability affects sites on Drupal core > 11.2 or any version of core with the HTMX library.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/htmlawed

Package

Name
drupal/htmlawed
Purl
pkg:composer/drupal/htmlawed?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Fixed
4.1.11
Database specific
Show details 
{
    "constraint": ">=4.1.0 <4.1.11"
}

Database specific

affected_versions 
">=4.1.0 <4.1.11"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/htmlawed/DRUPAL-CONTRIB-2026-315.json"