Unscored CVE-2026-122078 DRUPAL-CONTRIB-2026-309

The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTM…

Published Nov 4, 2026 · Updated Nov 4, 2026 · Assigned by DRUPAL

Description

The Extended HTML Filter module allows using style attributes in CKEditor.

The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.

Ecosystem	Package	Affected	Fixed	Record
Packagist	drupal/extended_html_filter	< 1.0.4	1.0.4	DRUPAL-CONTRIB-2026-309