[IT-SecNots] [Security-news] htmLawed - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-315

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-315

Project: htmLawed [1]
Project machine name: htmlawed
Date: 2026-November-04
Security risk: *Moderately critical* 14 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross-site scripting

Affected versions: >=4.1.0 <4.1.11
CVE IDs: CVE-2026-122079
Description: 
The htmLawed module enables use of the htmLawed [3] PHP library as a filter
in a Text Format for restriction/filtering of HTML in textual input.

The htmLawed filter does not sufficiently filter attributes, leading to a
cross-site scripting (XSS) vulnerability.

This vulnerability affects sites on Drupal core > 11.2 or any version of core
with the HTMX library.

Solution: 
Install the latest version:

 * If you use version 4.1.x, upgrade to 4.1.11 [4].
 * 8.x-3.x versions are not affected.

Review configuration and update:

 * For Text Formats that use the htmLawed filter, check that the filter's
   /Config./ setting includes /data-hx-*/ for the /deny_attribute/ parameter.
   E.g.: /'safe'=>1, 'elements'=>'a, em, strong, cite, code, ol, ul, li, dl,
   dt, dd', 'deny_attribute'=>'data-hx-*, id, style'/

Reported By: 
 * Pierre Rudloff (prudloff) [5] of the Drupal Security Team

Fixed By: 
 * alpha2zee [6]

Coordinated By: 
 * Swan Kalata (akalata) [7] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Juraj Nemec (poker10) [10] of the Drupal Security Team
 * Jess  (xjm) [11] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/htmlawed
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3]  
https://bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php
[4] https://www.drupal.org/project/htmlawed/releases/4.1.11
[5] https://www.drupal.org/u/prudloff
[6] https://www.drupal.org/u/alpha2zee
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/bramdriesen
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/poker10
[11] https://www.drupal.org/u/xjm
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3629221

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at