DRUPAL-CONTRIB-2026-334

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/cookies/DRUPAL-CONTRIB-2026-334.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-334
Published
2026-11-11T18:02:50Z
Modified
2026-11-11T18:45:03Z
Summary
[none]
Details

This module enables you to manage user consent for external services, such as embedded videos. The COOKiES Video submodule blocks external video elements until the visitor accepts the consent banner, then re-enables them.

The module doesn't sufficiently check the value of the data-cookies-video-blazy-src attribute when it converts it back to a src attribute for Blazy iframes. The protocol check added in SA-CONTRIB-2025-092 covered the other conversion paths but missed this one.

This vulnerability is mitigated by the fact that an attacker must have the correct permissions to have a specific HTML element display for all users, and that element must have a specific class set.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/cookies

Package

Name
drupal/cookies
Purl
pkg:composer/drupal/cookies?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.17
Database specific
Show details 
{
    "constraint": "<1.2.17"
}

Database specific

affected_versions 
"<1.2.17"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/cookies/DRUPAL-CONTRIB-2026-334.json"