DRUPAL-CONTRIB-2026-299: XSS

Q: What must an attacker be able to do to exploit this issue?

An attacker needs to supply crafted input to the module's CKEditor 5 preview endpoint. The insufficient validation can cause attacker-controlled script to be reflected in the response.

Q: Which deployments are exposed?

Deployments using the composer/drupal/highlight_js module and its CKEditor 5 preview endpoint are potentially exposed. The provided information does not state whether any particular configuration or permission setup is required.

Published Nov 4, 2026

Updated

This module enables you to add syntax-highlighted code snippets to content using CKEditor 5.

The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability.

Affected Software

1 affected componentFixes available

composer/drupal/highlight_js<1.3.1

1.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/highlight_js to a version that resolves this vulnerability.
Fixed in 1.3.1

Event History

Nov 4, 2026

Advisory Published

via OSV·05:32 PM

Data Sourced

via OSV·05:32 PM

DescriptionAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker needs to supply crafted input to the module's CKEditor 5 preview endpoint. The insufficient validation can cause attacker-controlled script to be reflected in the response.

Which deployments are exposed?

Deployments using the composer/drupal/highlight_js module and its CKEditor 5 preview endpoint are potentially exposed. The provided information does not state whether any particular configuration or permission setup is required.