November 2026 - Security-news

htmLawed - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-315
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-315 Project: htmLawed [1] Project machine name: htmlawed Date: 2026-November-04 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: >=4.1.0 <4.1.11 CVE IDs: CVE-2026-122079 Description: The htmLawed module enables use of the htmLawed [3] PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting (XSS) vulnerability. This vulnerability affects sites on Drupal core > 11.2 or any version of core with the HTMX library. Solution: Install the latest version: * If you use version 4.1.x, upgrade to 4.1.11 [4]. * 8.x-3.x versions are not affected. Review configuration and update: * For Text Formats that use the htmLawed filter, check that the filter's /Config./ setting includes /data-hx-*/ for the /deny_attribute/ parameter. E.g.: /'safe'=>1, 'elements'=>'a, em, strong, cite, code, ol, ul, li, dl, dt, dd', 'deny_attribute'=>'data-hx-*, id, style'/ Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * alpha2zee [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/htmlawed [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php [4] https://www.drupal.org/project/htmlawed/releases/4.1.11 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/alpha2zee [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

htmLawed - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-314
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-314 Project: htmLawed [1] Project machine name: htmlawed Date: 2026-November-04 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: >=3.0.0 <3.9.0 || >=4.0.0 <4.1.8 CVE IDs: CVE-2026-122080 Description: The htmLawed module enables use of the htmLawed [3] PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability. Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17. Solution: Install the latest version: * If you use version 4.1.x, upgrade to 4.1.11 [4] (/was fixed in 4.1.8/). * If you use version 8.x-3.x, upgrade to 8.x-3.10 [5] (/was fixed in 8.x-3.9/). Alternately, replace the htmLawed.php and htmLawed_README.htm files in the module directory with new downloads [6] for htmLawed library version >= 1.2.17. Reported By: * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Fixed By: * alpha2zee [8] * Pierre Rudloff (prudloff) [9] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/htmlawed [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php [4] https://www.drupal.org/project/htmlawed/releases/4.1.11 [5] https://www.drupal.org/project/htmlawed/releases/8.x-3.10 [6] https://bioinformatics.org/phplabware/internal_utilities/htmLawed/ [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/alpha2zee [9] https://www.drupal.org/u/prudloff [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Islandora - Moderately critical - Access bypass leading to arbitrary file overwrite - SA-CONTRIB-2026-313
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-313 Project: Islandora [1] Project machine name: islandora Date: 2026-November-04 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass leading to arbitrary file overwrite Affected versions: <2.19.1 CVE IDs: CVE-2026-122081 Description: Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files. The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output. This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media. Solution: Install the latest version: * Upgrade to Islandora 2.19.1 [3]. Reported By: * Whippet (VenusTech ADLab) (whippet) [4] Fixed By: * Annie Oelschlager (annieoelschlager) [5] * Joe Corall (joecorall) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/islandora [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/islandora/releases/2.19.1 [4] https://www.drupal.org/u/whippet [5] https://www.drupal.org/u/annieoelschlager [6] https://www.drupal.org/u/joecorall [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Mime Mail - Moderately critical - Information disclosure - SA-CONTRIB-2026-312
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-312 Project: Mime Mail [1] Project machine name: mimemail Date: 2026-November-04 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.0.4 CVE IDs: CVE-2026-122082 Description: The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory, This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and to send HTML emails and set the recipient list. Solution: Install the latest version: * Upgrade to Mime Mail 2.0.4 [3]. Reported By: * Rodel Duterte (rduterte) [4] Fixed By: * Mark Fullmer (mark_fullmer) [5] * Rodel Duterte (rduterte) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/mimemail [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/mimemail/releases/2.0.4 [4] https://www.drupal.org/u/rduterte [5] https://www.drupal.org/u/mark_fullmer [6] https://www.drupal.org/u/rduterte [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AdobeAnalytics - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-311
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-311 Project: AdobeAnalytics [1] Project machine name: adobe_analytics Date: 2026-November-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <1.1.0 CVE IDs: CVE-2026-122083 Description: This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality. Solution: Install the latest version: * Upgrade to adobe_analytics 8.x-1.1 [3]. Reported By: * Francisco Javier Rodriguez (nodles) [4] Fixed By: * Zeeshaan khann (zeeshan_khan) [5] * Joseph Olstad (joseph.olstad) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/adobe_analytics [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/adobe_analytics/releases/8.x-1.1 [4] https://www.drupal.org/u/nodles [5] https://www.drupal.org/u/zeeshan_khan [6] https://www.drupal.org/u/josepholstad [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

WordsOnline Connector - Moderately critical - SQL injection - SA-CONTRIB-2026-310
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-310 Project: WordsOnline Connector [1] Project machine name: wordsonline_connector Date: 2026-November-04 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:All/II:None/E:Theoretical/TD:All [2] Vulnerability: SQL injection Affected versions: >=2.0.0 <2.0.6 CVE IDs: CVE-2026-122084 Description: The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data. The vulnerability is mitigated by the fact that an attacker must be logged in and hold the /Create translation jobs/ permission provided by TMGMT. Solution: Install the latest version: * Upgrade to WordsOnline Connector 2.0.6 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Rey Kong (reykong) [5] * Luan Xuan Nguyen (luannguyen) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/wordsonline_connector [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/wordsonline_connector/releases/2.0.6 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/reykong [6] https://www.drupal.org/u/luannguyen [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Extended HTML Filter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-309
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-309 Project: Extended HTML Filter [1] Project machine name: extended_html_filter Date: 2026-November-04 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.0.4 CVE IDs: CVE-2026-122078 Description: The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes. Solution: Install the latest version: * Upgrade to Extended HTML Filter 1.0.4 [3]. Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Saif Bataineh (syfjo) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/extended_html_filter [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/extended_html_filter/releases/1.0.4 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/syfjo [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Allowed Languages - Less critical - Access bypass - SA-CONTRIB-2026-308
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-308 Project: Allowed Languages [1] Project machine name: allowed_languages Date: 2026-November-04 Security risk: *Less critical* 7 ∕ 25 AC:Complex/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-122077 Description: The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create content in at least one language. Solution: Install the latest version: * Upgrade to Allowed Languages 2.0.3 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Lucas Hedding (heddn) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/allowed_languages [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/allowed_languages/releases/2.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/heddn [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Password Separate Form - Moderately critical - Access bypass - SA-CONTRIB-2026-307
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-307 Project: Password Separate Form [1] Project machine name: change_pwd_page Date: 2026-November-04 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-122076 Description: This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one. The module doesn't sufficiently verify the current password in some cases. This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover. Solution: Install the latest version: * If you use version 2.0.x, upgrade to Password Separate Form 2.0.3 [3]. Reported By: * Motoki Kobayashi (otofu) [4] Fixed By: * Steven Ayers (bluegeek9) [5] * Motoki Kobayashi (otofu) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/change_pwd_page [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/change_pwd_page/releases/2.0.3 [4] https://www.drupal.org/u/otofu [5] https://www.drupal.org/u/bluegeek9 [6] https://www.drupal.org/u/otofu [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Scheduler - Moderately critical - Access bypass - SA-CONTRIB-2026-306
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-306 Project: Scheduler [1] Project machine name: scheduler Date: 2026-November-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.7.0 || >=2.2.0 <2.2.3 || 2.0.* || 2.1.* CVE IDs: CVE-2026-122075 Description: This module enables you to schedule content to be published or unpublished at a certain time in the future. The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the scheduled time, or content to become inaccessible earlier or later than planned. This vulnerability is mitigated by the fact that an attacker must already have permission to edit the affected content, and the content must be editable through a web services API like JSON:API or REST. Solution: Install the latest version: * If you use version 8.x-1.x, upgrade to Scheduler 8.x-1.7 [3]. * If you use version 2.2.x, upgrade to Scheduler 2.2.3 [4]. * If you use version 2.3.x, upgrade to Scheduler 2.3.1 [5]. * Version 2.1.x branch is no longer supported. Sites on this version should update to 2.2.3 or 2.3.1. Reported By: * Marcus Johansson (marcus_johansson) [6] * Rodrigo Cabo (rodrigo-cabo) [7] Fixed By: * Jonathan Smith (jonathan1055) [8] * Marcus Johansson (marcus_johansson) [9] * Pieter Frenssen (pfrenssen) [10] Coordinated By: * Swan Kalata (akalata) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/scheduler [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/scheduler/releases/8.x-1.7 [4] https://www.drupal.org/project/scheduler/releases/2.2.3 [5] https://www.drupal.org/project/scheduler/releases/2.3.1 [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/rodrigo-cabo [8] https://www.drupal.org/u/jonathan1055 [9] https://www.drupal.org/u/marcus_johansson [10] https://www.drupal.org/u/pfrenssen [11] https://www.drupal.org/u/akalata [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0