[IT-SecNots] [Security-news] Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-043

Project: Tagify [1]
Date: 2026-June-10
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross-site scripting (XSS)

Affected versions: <1.2.52
CVE IDs: CVE-2026-11908
Description: 
This module integrates the Tagify JavaScript library to enhance entity
reference selection in entity reference widgets.

The module does not properly sanitise the name of parent taxonomy terms when
rendering suggestions in the Tagify dropdown. This results in a cross-site
scripting vulnerability that may allow attackers to execute arbitrary
JavaScript in the context of the user’s session.

The vulnerability is mitigated by the fact an attacker must have a role with
permission to create or edit taxonomy terms in a vocabulary.

Solution: 
Install the latest version of the Tagify module that includes a fix for
sanitising parent term names in the Tagify dropdown rendering.

 * If you use the Tagify module for Drupal, upgrade to tagify 1.2.52 [3].

More information will be provided in the project release notes once the fixed
version is published.

Reported By: 
 * Pierre Rudloff (prudloff) [4] of the Drupal Security Team

Fixed By: 
 * David Galeano (gxleano) [5]

Coordinated By: 
 * Greg Knaddison (greggles) [6] of the Drupal Security Team
 * Dave Long (longwave) [7] of the Drupal Security Team
 * Pierre Rudloff (prudloff) [8] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/185106-tagify-security/-/work_items/1
[9]
------------------------------------------------------------------------------
Contribution record [10]

[1] https://www.drupal.org/project/tagify
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/tagify/releases/1.2.52
[4] https://www.drupal.org/u/prudloff
[5] https://www.drupal.org/u/gxleano
[6] https://www.drupal.org/u/greggles
[7] https://www.drupal.org/u/longwave
[8] https://www.drupal.org/u/prudloff
[9] https://git.drupalcode.org/security/185106-tagify-security/-/work_items/1
[10]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3593444

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at