DRUPAL-CONTRIB-2026-315: XSS
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting (XSS) vulnerability.
This vulnerability affects sites on Drupal core > 11.2 or any version of core with the HTMX library.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/htmlawedto a version that resolves this vulnerability.Fixed in 4.1.11
Event History
Frequently Asked Questions
Which sites are affected by this issue?
Sites using the composer/drupal/htmlawed module are affected when they run Drupal core later than 11.2, or when they run any Drupal core version with the HTMX library.
What configuration is necessary for exploitation?
The vulnerable htmLawed filter must be enabled in a Text Format that processes textual input. The issue stems from insufficient filtering of HTML attributes by that filter.
What is the potential impact?
An attacker may be able to introduce cross-site scripting through HTML attributes that are not sufficiently filtered, causing attacker-controlled script to execute in users' browsers.