SA-CONTRIB-2026-234: Critical severity drupal/uswds_paragraph_components vulnerability
Published Oct 21, 2026
·Updated
This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passed to its markup. This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph bundles provided by the module.
Credit
Hemant Gupta (guptahemant), Lee Rowlands (larowlan)(the Drupal Security Team)
Affected Software
1 affected componentFixes available
drupal/uswds_paragraph_components<3.1.3
3.1.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/uswds_paragraph_componentsto a version that resolves this vulnerability.Fixed in 3.1.3
Event History
Oct 21, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software