View online: https://www.drupal.org/sa-contrib-2026-314 Project: htmLawed [1] Project machine name: htmlawed Date: 2026-November-04 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: >=3.0.0 <3.9.0 || >=4.0.0 <4.1.8 CVE IDs: CVE-2026-122080 Description:  The htmLawed module enables use of the htmLawed [3] PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability. Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17. Solution:  Install the latest version: * If you use version 4.1.x, upgrade to 4.1.11 [4] (/was fixed in 4.1.8/). * If you use version 8.x-3.x, upgrade to 8.x-3.10 [5] (/was fixed in 8.x-3.9/). Alternately, replace the htmLawed.php and htmLawed_README.htm files in the module directory with new downloads [6] for htmLawed library version >= 1.2.17. Reported By:  * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Fixed By:  * alpha2zee [8] * Pierre Rudloff (prudloff) [9] of the Drupal Security Team Coordinated By:  * Swan Kalata (akalata) [10] of the Drupal Security Team * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/htmlawed [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php [4] https://www.drupal.org/project/htmlawed/releases/4.1.11 [5] https://www.drupal.org/project/htmlawed/releases/8.x-3.10 [6] https://bioinformatics.org/phplabware/internal_utilities/htmLawed/ [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/alpha2zee [9] https://www.drupal.org/u/prudloff [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....