Project:
Project machine name:
htmlawedDate:
2026-November-04
Vulnerability:
Cross-site scripting
Affected versions:
>=4.1.0 <4.1.11
CVE IDs:
CVE-2026-122079
Description:
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting (XSS) vulnerability.
This vulnerability affects sites on Drupal core > 11.2 or any version of core with the HTMX library.
Solution:
Install the latest version:
- If you use version 4.1.x, upgrade to 4.1.11.
- 8.x-3.x versions are not affected.
Review configuration and update:
- For Text Formats that use the htmLawed filter, check that the filter's Config. setting includes data-hx-* for the deny_attribute parameter. E.g.: 'safe'=>1, 'elements'=>'a, em, strong, cite, code, ol, ul, li, dl, dt, dd', 'deny_attribute'=>'data-hx-*, id, style'
Reported By:
- Pierre Rudloff (prudloff) of the Drupal Security Team
Fixed By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
