DRUPAL-CONTRIB-2026-325: Composer/drupal/paragraphs_entity_embed vulnerability

Q: Who can exploit this vulnerability?

An attacker must have permission to edit the label of the paragraph entity. Users without that permission are not identified as able to exploit it.

Q: Where does the malicious input enter?

The issue is in the autocomplete search filter used by the module. Malicious text is not sufficiently filtered, allowing cross-site scripting.

Q: How can I determine whether my site may be affected?

Review whether composer/drupal/paragraphs_entity_embed is installed and whether any users or roles can edit paragraph entity labels. Sites without such permission assignments have the stated mitigation in place.

Published Nov 11, 2026

Updated

This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG editor.

The module doesn't sufficiently filter for malicious text in the autocomplete search filter, leading to a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have permission to edit the label of the paragraph entity.

Affected Software

1 affected componentFixes available

composer/drupal/paragraphs_entity_embed<4.0.1

4.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/paragraphs_entity_embed to a version that resolves this vulnerability.
Fixed in 4.0.1

Event History

Nov 11, 2026

Advisory Published

via OSV·05:49 PM

Data Sourced

via OSV·05:49 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must have permission to edit the label of the paragraph entity. Users without that permission are not identified as able to exploit it.

Where does the malicious input enter?

The issue is in the autocomplete search filter used by the module. Malicious text is not sufficiently filtered, allowing cross-site scripting.

How can I determine whether my site may be affected?

Review whether composer/drupal/paragraphs_entity_embed is installed and whether any users or roles can edit paragraph entity labels. Sites without such permission assignments have the stated mitigation in place.

DRUPAL-CONTRIB-2026-325: Composer/drupal/paragraphs_entity_embed vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Where does the malicious input enter?

How can I determine whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Where does the malicious input enter?

How can I determine whether my site may be affected?