CVE-2026-126741: Composer/drupal/smart_trim vulnerability
This module implements a field formatter for text fields that improves the Summary or Trimmed formatter built into Drupal core.
The module doesn't sufficiently escape unsafe HTML when passed through the module's Twig filter.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to post content that gets passed through a Twig template with one of the |smarttrim filters provided by this module.
If a site uses only use the field formatter without the Twig filter, it is not vulnerable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/smart_trimto a version that resolves this vulnerability.Fixed in 2.2.2 - Upgrade
Upgrade
composer/drupal/smart_trimto a version that resolves this vulnerability.Fixed in 2.3.2 - Compensating control
Restrict roles from posting content that is passed through a Twig template using one of the module's |smart_trim_* filters.
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
A site is exposed only if untrusted content can be posted by a user whose content is later rendered through a Twig template using one of the module's |smart_trim_* filters. Sites that use only the field formatter are not vulnerable.
What level of attacker access is required?
An attacker needs a role that can post content which is passed through a Twig template using a |smart_trim_* filter. The provided information does not indicate that unauthenticated access alone is sufficient.
How can I determine whether my site is affected?
Review Twig templates for use of the module's |smart_trim_* filters and determine whether content posted by roles with content-creation permissions can reach those filters. If the module is used only as a field formatter and its Twig filters are not used, the site is not vulnerable.
What can be done if patching cannot happen immediately?
Avoid passing user-posted or otherwise untrusted content through Twig templates that use the module's |smart_trim_* filters. Using only the field formatter does not trigger this vulnerability.