View online: https://www.drupal.org/sa-contrib-2023-043 Project: highlight.php [1] Date: 2023-September-06 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: < 1.0.1 Description:  Provides highlight.php [3] integration to Drupal, allowing blocks to be automatically highlighted with the correct language. The module's Twig function doesn't sufficiently filter user-entered data. Solution:  Install the latest version: * If you use the highlight.php module, upgrade to highlight.php 1.0.1 [4] Reported By:  * Pierre Rudloff [5] Fixed By:  * Andrei Ivnitskii [6] * Pierre Rudloff [7] Coordinated By:  * Benji Fisher [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/highlight_php [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/scrivo/highlight.php [4] https://www.drupal.org/project/highlight_php/releases/1.0.1 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/3547706 [7] https://www.drupal.org/user/3611858 [8] https://www.drupal.org/user/683300 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/36762