DRUPAL-CONTRIB-2026-334: Composer/drupal/cookies vulnerability

Q: Who is realistically exposed to this issue?

Sites using the COOKiES Video submodule with Blazy iframes are exposed when a user can create or alter HTML that will be displayed to all users. The relevant element must also have the specific class required for this conversion path.

Q: What does an attacker need to exploit it?

An attacker needs the permissions required to make a specific HTML element display for all users. They must be able to set the data-cookies-video-blazy-src attribute and ensure the element has the required class.

Q: Does the mitigation added in the earlier advisory cover this case?

No. The protocol check added in SA-CONTRIB-2025-092 covered other attribute-to-src conversion paths, but not the data-cookies-video-blazy-src conversion used for Blazy iframes.

Published Nov 11, 2026

Updated

This module enables you to manage user consent for external services, such as embedded videos. The COOKiES Video submodule blocks external video elements until the visitor accepts the consent banner, then re-enables them.

The module doesn't sufficiently check the value of the data-cookies-video-blazy-src attribute when it converts it back to a src attribute for Blazy iframes. The protocol check added in SA-CONTRIB-2025-092 covered the other conversion paths but missed this one.

This vulnerability is mitigated by the fact that an attacker must have the correct permissions to have a specific HTML element display for all users, and that element must have a specific class set.

Affected Software

1 affected componentFixes available

composer/drupal/cookies<1.2.17

1.2.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/cookies to a version that resolves this vulnerability.
Fixed in 1.2.17

Event History

Nov 11, 2026

Advisory Published

via OSV·06:02 PM

Data Sourced

via OSV·06:02 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Sites using the COOKiES Video submodule with Blazy iframes are exposed when a user can create or alter HTML that will be displayed to all users. The relevant element must also have the specific class required for this conversion path.

What does an attacker need to exploit it?

An attacker needs the permissions required to make a specific HTML element display for all users. They must be able to set the data-cookies-video-blazy-src attribute and ensure the element has the required class.

Does the mitigation added in the earlier advisory cover this case?

No. The protocol check added in SA-CONTRIB-2025-092 covered other attribute-to-src conversion paths, but not the data-cookies-video-blazy-src conversion used for Blazy iframes.

DRUPAL-CONTRIB-2026-334: Composer/drupal/cookies vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Does the mitigation added in the earlier advisory cover this case?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Does the mitigation added in the earlier advisory cover this case?