[IT-SecNots] [Security-news] htmLawed - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-314

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-314

Project: htmLawed [1]
Project machine name: htmlawed
Date: 2026-November-04
Security risk: *Moderately critical* 11 ∕ 25
AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Cross-site scripting

Affected versions: >=3.0.0 <3.9.0 || >=4.0.0 <4.1.8
CVE IDs: CVE-2026-122080
Description: 
The htmLawed module enables use of the htmLawed [3] PHP library as a filter
in a Text Format for restriction/filtering of HTML in textual input.

The module's filtering of malicious HTML can be bypassed by using a malformed
UTF8 character, leading to a cross-site scripting (XSS) vulnerability.

Only sites using an SQLite database are affected with versions of the
htmLawed library prior to 1.2.17.

Solution: 
Install the latest version:

 * If you use version 4.1.x, upgrade to 4.1.11 [4] (/was fixed in 4.1.8/).
 * If you use version 8.x-3.x, upgrade to 8.x-3.10 [5] (/was fixed in
   8.x-3.9/).

Alternately, replace the htmLawed.php and htmLawed_README.htm files in the
module directory with new downloads [6] for htmLawed library version >=
1.2.17.

Reported By: 
 * Pierre Rudloff (prudloff) [7] of the Drupal Security Team

Fixed By: 
 * alpha2zee [8]
 * Pierre Rudloff (prudloff) [9] of the Drupal Security Team

Coordinated By: 
 * Swan Kalata (akalata) [10] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [11] of the Drupal Security Team
 * Juraj Nemec (poker10) [12] of the Drupal Security Team
 * Jess  (xjm) [13] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [14]

[1] https://www.drupal.org/project/htmlawed
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3]  
https://bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php
[4] https://www.drupal.org/project/htmlawed/releases/4.1.11
[5] https://www.drupal.org/project/htmlawed/releases/8.x-3.10
[6] https://bioinformatics.org/phplabware/internal_utilities/htmLawed/
[7] https://www.drupal.org/u/prudloff
[8] https://www.drupal.org/u/alpha2zee
[9] https://www.drupal.org/u/prudloff
[10] https://www.drupal.org/u/akalata
[11] https://www.drupal.org/u/bramdriesen
[12] https://www.drupal.org/u/poker10
[13] https://www.drupal.org/u/xjm
[14]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3634677

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at