View online: https://www.drupal.org/sa-contrib-2026-234 Project: USWDS Paragraph Components [1] Project machine name: uswds_paragraph_components Date: 2026-October-21 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <3.1.3 CVE IDs: CVE-2026-114536 Description:  This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passed to its markup. This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph bundles provided by the module. Solution:  Install the latest version: * If you use the USWDS Paragraph Components, upgrade to USWDS Paragraph Components 3.1.3 [3] Reported By:  * Hemant Gupta (guptahemant) [4] * Lee Rowlands (larowlan) [5] of the Drupal Security Team Fixed By:  * Stephen Mustgrave (smustgrave) [6] Coordinated By:  * Swan Kalata (akalata) [7] of the Drupal Security Team * Lee Rowlands (larowlan) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/uswds_paragraph_components [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/uswds_paragraph_components/releases/3.1.3 [4] https://www.drupal.org/u/guptahemant [5] https://www.drupal.org/u/larowlan [6] https://www.drupal.org/u/smustgrave [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/larowlan [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....