CVE-2026-122068: XSS

Q: Which deployments should prioritize triage?

Deployments using this module to add syntax-highlighted code snippets through CKEditor 5 should prioritize review, because the affected functionality includes its CKEditor 5 preview endpoint.

Q: What input path is implicated?

The issue is triggered by input passed to the module's CKEditor 5 preview endpoint. That endpoint does not sufficiently validate the input before it is reflected.

Published Nov 4, 2026

Updated

This module enables you to add syntax-highlighted code snippets to content using CKEditor 5.

The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability.

Affected Software

1 affected componentFixes available

composer/drupal/highlight_js<1.3.1

1.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/highlight_js to a version that resolves this vulnerability.
Fixed in 1.3.1

Event History

Nov 4, 2026

Advisory Published

via OSV·05:32 PM

Data Sourced

via OSV·05:32 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments should prioritize triage?

Deployments using this module to add syntax-highlighted code snippets through CKEditor 5 should prioritize review, because the affected functionality includes its CKEditor 5 preview endpoint.

What input path is implicated?

The issue is triggered by input passed to the module's CKEditor 5 preview endpoint. That endpoint does not sufficiently validate the input before it is reflected.