Project:
Project machine name:
smart_trimDate:
2026-November-11
Security risk:
Vulnerability:
Cross-site scripting
Affected versions:
<2.2.2 || >=2.3.0 <2.3.2
CVE IDs:
CVE-2026-126741
Description:
This module implements a field formatter for text fields that improves the Summary or Trimmed formatter built into Drupal core.
The module doesn't sufficiently escape unsafe HTML when passed through the module's Twig filter.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to post content that gets passed through a Twig template with one of the |smart_trim_* filters provided by this module.
If a site uses only use the field formatter without the Twig filter, it is not vulnerable.
Solution:
Install the latest version:
- If you use version 2.3.x, upgrade to Smart Trim 2.3.2.
- If you use version 2.2.x, upgrade to Smart Trim 2.2.2.
Reported By:
- Pierre Rudloff (prudloff) of the Drupal Security Team
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
