CVE-2026-126734: Composer/drupal/paragraphs_entity_embed vulnerability
This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG editor.
The module doesn't sufficiently filter for malicious text in the autocomplete search filter, leading to a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have permission to edit the label of the paragraph entity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/paragraphs_entity_embedto a version that resolves this vulnerability.Fixed in 4.0.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have permission to edit the label of the paragraph entity. The vulnerability is therefore mitigated where that permission is restricted to trusted users.
Where does the malicious input enter the application?
The issue is in the autocomplete search filter used by the module’s WYSIWYG embedding functionality. Malicious text is not sufficiently filtered, allowing cross-site scripting.
What should be reviewed while remediation is pending?
Review which accounts and roles can edit paragraph entity labels, and restrict that permission to trusted users where possible. This directly reduces who can supply the malicious autocomplete search text.