SA-CONTRIB-2026-325: Critical severity composer/drupal/paragraphs_entity_embed vulnerability
This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG editor. The module doesn't sufficiently filter for malicious text in the autocomplete search filter, leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to edit the label of the paragraph entity.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/paragraphs_entity_embedto a version that resolves this vulnerability.Fixed in 4.0.1
Event History
Frequently Asked Questions
What level of access would an attacker need to exploit this issue?
An attacker must have permission to edit the label of a paragraph entity. This permission requirement mitigates exposure compared with an issue exploitable by anonymous or view-only users.
What access should be reviewed while addressing the vulnerability?
Review which accounts and roles can edit paragraph entity labels, and limit that permission to trusted users. The vulnerable input is the autocomplete search filter used by the module.