CVE-2026-122080: XSS
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.
Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/htmlawedto a version that resolves this vulnerability.Fixed in 3.9.0 - Upgrade
Upgrade
composer/drupal/htmlawedto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
htmLawedto a version that resolves this vulnerability.Fixed in 1.2.17
Event History
Frequently Asked Questions
Which deployments are affected?
Only sites that use the htmLawed module with an SQLite database are affected, and only when the bundled or installed htmLawed library version is earlier than 1.2.17.
What must an attacker be able to do to exploit this issue?
An attacker must be able to submit textual input that is processed by a Text Format using htmLawed. The bypass relies on a malformed UTF-8 character in input that would otherwise be filtered as malicious HTML.
Is a site affected merely by having the module installed?
No. The affected condition requires use of SQLite and a version of the htmLawed library prior to 1.2.17; exploitation also depends on attacker-controlled content being filtered through a Text Format that uses htmLawed.