DRUPAL-CONTRIB-2026-314: XSS
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.
Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/htmlawedto a version that resolves this vulnerability.Fixed in 3.9.0 - Upgrade
Upgrade
composer/drupal/htmlawedto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
htmLawedto a version that resolves this vulnerability.Fixed in 1.2.17
Event History
Frequently Asked Questions
Which deployments are affected?
Only sites using the htmLawed module with an SQLite database are affected, and only when the bundled or installed htmLawed library version is earlier than 1.2.17.
What does an attacker need to exploit this issue?
The attacker needs a way to submit textual input that is processed by a Text Format using htmLawed. The bypass relies on a malformed UTF-8 character in the submitted HTML.
What is the practical impact of successful exploitation?
Malicious HTML filtering can be bypassed, resulting in cross-site scripting. This can cause attacker-controlled script content to be rendered in affected text.