SA-CONTRIB-2026-318: Critical severity composer/drupal/texts vulnerability

Q: Who can exploit this issue?

An attacker must have either the "Create string translation" or "Edit string translation" permission. Users without one of those permissions cannot inject the malicious translation content described.

Q: Are all sites using the module affected?

No. Exploitation also requires the site to render the attacker-controlled translated text through the module's Twig filters. Sites that do not render those translations using those filters are not exposed through this attack path.

Q: What should be reviewed while remediation is pending?

Review which accounts and roles have the "Create string translation" or "Edit string translation" permission, and restrict those permissions to trusted users. Also identify pages that render Texts translations through the module's Twig filters and review existing translations created by users with those permissions.

Published Nov 11, 2026

Updated

The Texts module provides key-based strings and translations for Drupal, including Twig filters for displaying translated text. The module does not sufficiently validate translation HTML and can display stored translations without sufficient filtering. A user who can create or edit string translations could inject JavaScript into pages that render those translations. This vulnerability is mitigated by the fact that an attacker must have the "Create string translation" or "Edit string translation" permission, and a site must render the affected text using the module’s Twig filters.

Credit

Jens Vranckx (vrancje)

Affected Software

1 affected componentFixes available

composer/drupal/texts<1.0.17

1.0.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/texts to a version that resolves this vulnerability.
Fixed in 1.0.17

Event History

Nov 11, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-126727

Frequently Asked Questions

Who can exploit this issue?

An attacker must have either the "Create string translation" or "Edit string translation" permission. Users without one of those permissions cannot inject the malicious translation content described.

Are all sites using the module affected?

No. Exploitation also requires the site to render the attacker-controlled translated text through the module's Twig filters. Sites that do not render those translations using those filters are not exposed through this attack path.

What should be reviewed while remediation is pending?

Review which accounts and roles have the "Create string translation" or "Edit string translation" permission, and restrict those permissions to trusted users. Also identify pages that render Texts translations through the module's Twig filters and review existing translations created by users with those permissions.

SA-CONTRIB-2026-318: Critical severity composer/drupal/texts vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

Are all sites using the module affected?

What should be reviewed while remediation is pending?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are all sites using the module affected?

What should be reviewed while remediation is pending?