SA-CONTRIB-2026-309: XSS
The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/extended_html_filterto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites using the Extended HTML Filter module and allowing users to insert HTML containing the affected HTMX attributes are exposed. The issue is mitigated where untrusted users cannot insert HTML with those specific attributes.
What does an attacker need to exploit the vulnerability?
An attacker must be able to insert HTML with specific HTMX attributes that are not sufficiently sanitized by the module's XSS filter.