View online: https://www.drupal.org/sa-contrib-2026-309 Project: Extended HTML Filter [1] Project machine name: extended_html_filter Date: 2026-November-04 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.0.4 CVE IDs: CVE-2026-122078 Description: The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes. Solution: Install the latest version: * Upgrade to Extended HTML Filter 1.0.4 [3]. Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Saif Bataineh (syfjo) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/extended_html_filter [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/extended_html_filter/releases/1.0.4 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/syfjo [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/xjm [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....