DRUPAL-CONTRIB-2026-332: Composer/drupal/smart_trim vulnerability

Q: When is a site actually exposed?

A site is exposed only when content submitted by a user is passed through a Twig template using one of this module's |smart_trim_* filters. Using the module solely as a field formatter does not make the site vulnerable.

Q: What level of attacker access is required?

An attacker needs a role that can post content and must be able to have that content rendered through a Twig template using a |smart_trim_* filter. The provided information does not indicate that unauthenticated users can exploit it by default.

Published Nov 11, 2026

Updated

This module implements a field formatter for text fields that improves the Summary or Trimmed formatter built into Drupal core.

The module doesn't sufficiently escape unsafe HTML when passed through the module's Twig filter.

This vulnerability is mitigated by the fact that an attacker must have a role with the ability to post content that gets passed through a Twig template with one of the |smarttrim filters provided by this module.

If a site uses only use the field formatter without the Twig filter, it is not vulnerable.

Affected Software

2 affected componentsFixes available

composer/drupal/smart_trim<2.2.2

2.2.2

composer/drupal/smart_trim>=2.3.0<2.3.2

2.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/smart_trim to a version that resolves this vulnerability.
Fixed in 2.2.2
Upgrade
Upgrade composer/drupal/smart_trim to a version that resolves this vulnerability.
Fixed in 2.3.2
Configuration
Use only the field formatter and do not pass content through any of the module's |smart_trim_* Twig filters.
Drupal module's Twig templates smart_trim_* Twig filters = not used

Event History

Nov 11, 2026

Advisory Published

via OSV·06:00 PM

Data Sourced

via OSV·06:00 PM

DescriptionAffected Software

Frequently Asked Questions

When is a site actually exposed?

A site is exposed only when content submitted by a user is passed through a Twig template using one of this module's |smart_trim_* filters. Using the module solely as a field formatter does not make the site vulnerable.

What level of attacker access is required?

An attacker needs a role that can post content and must be able to have that content rendered through a Twig template using a |smart_trim_* filter. The provided information does not indicate that unauthenticated users can exploit it by default.

DRUPAL-CONTRIB-2026-332: Composer/drupal/smart_trim vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

When is a site actually exposed?

What level of attacker access is required?

Company

Resources

Contact

Frequently Asked Questions

When is a site actually exposed?

What level of attacker access is required?