Problem/motivation

This was flagged by an AI security scanner, but the steps are so unlikely, so any risk calculator score is "Less Critical" or less, so under https://www.drupal.org/psa-2023-07-12 I post this publicly.

Steps to reproduce

1. Install and enable linkit 7.0.17 on a Drupal 11 site.
2. Create a text format (for example "Linkit repro") whose only filter is the Linkit filter, with the default `title` setting left on.
3. Create an published node that is a draft with just title "Temporary" beacuse you are drafting a message.
4. Create a published node whose body uses the Linkit format and contains a Linkit anchor to the published node.
5. Unpublish the first node and rename it to "SECRET-Q3-Layoffs-Plan"
6. As the same anonymous visitor, request the published node with the link. The served HTML contains `title="SECRET-Q3-Layoffs-Plan"` on the Linkit link, disclosing the unpublished node's new title.

Proposed resolution

Comments

marcus_johansson created an issue.