Vulnerability DRUPAL-CONTRIB-2026-314
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 hours ago
November 04, 2026 at 05:52 PM UTC
No summary available
>=3.0.0 <3.9.0, >=4.0.0 <4.1.8
>=3.0.0 <3.9.0, >=4.0.0 <4.1.8
Details
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.
Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
4 hours ago
November 04, 2026 at 05:52 PM UTC
Last Modified
1 hour ago
November 04, 2026 at 08:30 PM UTC