SA-CONTRIB-2026-299: XSS
This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/highlight_jsto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to be able to supply crafted input to the module's CKEditor 5 preview endpoint. The issue is reflected XSS, so the crafted input must be processed by that endpoint and delivered to a victim's browser.
Who is exposed to this vulnerability?
Sites using the module to add syntax-highlighted code snippets through CKEditor 5 are exposed if the vulnerable preview endpoint is reachable by users who can submit attacker-controlled input. The provided information does not specify which roles or access controls can reach the endpoint.
How can I determine whether my site may be affected?
Check whether this module is installed and used with CKEditor 5 for syntax-highlighted code snippets. Review access to its CKEditor 5 preview endpoint and test whether crafted preview input is reflected into the response without sufficient validation.