SA-CONTRIB-2026-314: XSS

Q: Which deployments are affected?

Only sites using an SQLite database are affected, and only when the htmLawed library version is earlier than 1.2.17.

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to submit textual input processed through a Text Format that uses htmLawed as an HTML restriction/filtering mechanism. The bypass relies on a malformed UTF-8 character in that input.

Q: How can I determine whether my site is exposed?

Check whether the site uses SQLite, whether a Text Format is configured to use the htmLawed filter, and whether the installed htmLawed library version is prior to 1.2.17.

Published Nov 4, 2026

Updated

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability. Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.

Credit

Pierre Rudloff (prudloff)(the Drupal Security Team)

Affected Software

1 affected componentFixes available

composer/drupal/htmlawed<4.1.11, <8.x-3.10

4.1.118.x-3.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/htmlawed to a version that resolves this vulnerability.
Fixed in 4.1.11Fixed in 8.x-3.10
Upgrade
Upgrade htmLawed PHP library to a version that resolves this vulnerability.
Fixed in 1.2.17

Event History

Nov 4, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122080

Frequently Asked Questions

Which deployments are affected?

Only sites using an SQLite database are affected, and only when the htmLawed library version is earlier than 1.2.17.

What does an attacker need to exploit this issue?

An attacker needs to be able to submit textual input processed through a Text Format that uses htmLawed as an HTML restriction/filtering mechanism. The bypass relies on a malformed UTF-8 character in that input.

How can I determine whether my site is exposed?

Check whether the site uses SQLite, whether a Text Format is configured to use the htmLawed filter, and whether the installed htmLawed library version is prior to 1.2.17.

SA-CONTRIB-2026-314: XSS

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether my site is exposed?