SA-CONTRIB-2026-334: Critical severity composer/drupal/cookies vulnerability
This module enables you to manage user consent for external services, such as embedded videos. The COOKiES Video submodule blocks external video elements until the visitor accepts the consent banner, then re-enables them. The module doesn't sufficiently check the value of the data-cookies-video-blazy-src attribute when it converts it back to a src attribute for Blazy iframes. The protocol check added in SA-CONTRIB-2025-092 covered the other conversion paths but missed this one. This vulnerability is mitigated by the fact that an attacker must have the correct permissions to have a specific HTML element display for all users, and that element must have a specific class set.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/cookiesto a version that resolves this vulnerability.Fixed in 1.2.17
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Sites are exposed if a user has permission to make a specific HTML element display to all users and can ensure that element has the required specific class. The issue affects the COOKiES Video submodule's handling of Blazy iframes.
What must an attacker be able to do?
An attacker must be able to supply or control the data-cookies-video-blazy-src attribute on a qualifying HTML element that is displayed to all users, and set the required class on that element. The vulnerable path converts that attribute back into a src attribute without sufficient protocol validation.
Does the earlier protocol-check fix cover this case?
No. The protocol check introduced in SA-CONTRIB-2025-092 covered other conversion paths, but did not cover the conversion of data-cookies-video-blazy-src to src for Blazy iframes.