SA-CONTRIB-2026-315: XSS
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting (XSS) vulnerability. This vulnerability affects sites on Drupal core > 11.2 or any version of core with the HTMX library.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/htmlawedto a version that resolves this vulnerability.Fixed in 4.1.11
Event History
Frequently Asked Questions
Which Drupal sites are affected?
Affected sites are those using the htmLawed module on Drupal core versions later than 11.2, or on any core version that includes the HTMX library.
What configuration makes this exploitable?
The htmLawed PHP library must be enabled as a filter in a Text Format that is used to restrict or filter HTML input. The issue is insufficient filtering of HTML attributes.
What could an attacker do?
An attacker could exploit insufficient attribute filtering to inject cross-site scripting payloads through textual input processed by an affected htmLawed Text Format.