View online: https://www.drupal.org/sa-contrib-2026-315 Project: htmLawed [1] Project machine name: htmlawed Date: 2026-November-04 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: >=4.1.0 <4.1.11 CVE IDs: CVE-2026-122079 Description:  The htmLawed module enables use of the htmLawed [3] PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting (XSS) vulnerability. This vulnerability affects sites on Drupal core > 11.2 or any version of core with the HTMX library. Solution:  Install the latest version: * If you use version 4.1.x, upgrade to 4.1.11 [4]. * 8.x-3.x versions are not affected. Review configuration and update: * For Text Formats that use the htmLawed filter, check that the filter's /Config./ setting includes /data-hx-*/ for the /deny_attribute/ parameter. E.g.: /'safe'=>1, 'elements'=>'a, em, strong, cite, code, ol, ul, li, dl, dt, dd', 'deny_attribute'=>'data-hx-*, id, style'/ Reported By:  * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By:  * alpha2zee [6] Coordinated By:  * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/htmlawed [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php [4] https://www.drupal.org/project/htmlawed/releases/4.1.11 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/alpha2zee [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....