View online: https://www.drupal.org/sa-contrib-2023-043
Project: highlight.php [1] Date: 2023-September-06 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting
Affected versions: < 1.0.1 Description: Provides highlight.php [3] integration to Drupal, allowing blocks to be automatically highlighted with the correct language.
The module's Twig function doesn't sufficiently filter user-entered data.
Solution: Install the latest version:
* If you use the highlight.php module, upgrade to highlight.php 1.0.1 [4]
Reported By: * Pierre Rudloff [5]
Fixed By: * Andrei Ivnitskii [6] * Pierre Rudloff [7]
Coordinated By: * Benji Fisher [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team
[1] https://www.drupal.org/project/highlight_php [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/scrivo/highlight.php [4] https://www.drupal.org/project/highlight_php/releases/1.0.1 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/3547706 [7] https://www.drupal.org/user/3611858 [8] https://www.drupal.org/user/683300 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/36762