Vulnerability DRUPAL-CONTRIB-2026-309
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 hours ago
November 04, 2026 at 05:51 PM UTC
No summary available
<1.0.4
<1.0.4
Details
The Extended HTML Filter module allows using style attributes in CKEditor.
The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.
References
Impacted packages
Timeline
Published
4 hours ago
November 04, 2026 at 05:51 PM UTC
Last Modified
1 hour ago
November 04, 2026 at 08:30 PM UTC