CVE-2026-122079: XSS
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting (XSS) vulnerability.
This vulnerability affects sites on Drupal core > 11.2 or any version of core with the HTMX library.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/htmlawedto a version that resolves this vulnerability.Fixed in 4.1.11
Event History
Frequently Asked Questions
Which Drupal sites should be considered potentially affected?
Sites running Drupal core later than 11.2 are affected. Sites running any Drupal core version with the HTMX library are also affected.
What would an attacker need to exploit this issue?
An attacker would need to submit HTML-containing textual input that is processed through a Text Format using the htmLawed filter. Insufficient filtering of attributes can allow cross-site scripting payloads to pass through.
How can I quickly assess exposure?
Check whether the site runs Drupal core later than 11.2 or includes the HTMX library. Also identify Text Formats configured to use the htmLawed filter, especially where untrusted users can submit textual input.