CVE-2026-122068
No scoreFix available
CVE-2026-122068 is a vulnerability with no CVSS score yet in drupal/highlight_js, published November 4, 2026. No source lists public exploit code. Fixed in drupal/highlight_js 1.3.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.3.1drupal/highlight_js
Description
This module enables you to add syntax-highlighted code snippets to content using CKEditor 5.
The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/highlight_jsPackagist:https://packages.drupal.org/8 | before 1.3.1 | 1.3.1 |
What each source reports
OSVDRUPAL-CONTRIB-2026-299No score
This module enables you to add syntax-highlighted code snippets to content using CKEditor 5.
The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability.
- Record
DRUPAL-CONTRIB-2026-299- Updated
- 2026-11-04
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.