DRUPAL-CONTRIB-2026-309: XSS

Q: Who is realistically exposed to this vulnerability?

Sites using the composer/drupal/extended_html_filter module are exposed where users can insert HTML containing the specific HTMX attributes that the module does not sufficiently sanitize.

Q: What does an attacker need to exploit the issue?

An attacker must be able to insert HTML with specific attributes. The advisory identifies insufficient sanitization of certain HTMX attributes as the condition enabling XSS.

Published Nov 4, 2026

Updated

The Extended HTML Filter module allows using style attributes in CKEditor.

The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.

Affected Software

1 affected componentFixes available

composer/drupal/extended_html_filter<1.0.4

1.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/extended_html_filter to a version that resolves this vulnerability.
Fixed in 1.0.4

Event History

Nov 4, 2026

Advisory Published

via OSV·05:51 PM

Data Sourced

via OSV·05:51 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

Sites using the composer/drupal/extended_html_filter module are exposed where users can insert HTML containing the specific HTMX attributes that the module does not sufficiently sanitize.

What does an attacker need to exploit the issue?

An attacker must be able to insert HTML with specific attributes. The advisory identifies insufficient sanitization of certain HTMX attributes as the condition enabling XSS.