CVE-2026-122080
CVE-2026-122080 is a vulnerability with no CVSS score yet in drupal/htmlawed, published November 4, 2026. No source lists public exploit code. Fixed in drupal/htmlawed 3.9.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.9.0drupal/htmlawed
Description
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.
Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/htmlawedPackagist:https://packages.drupal.org/8 | 3.0.0 up to 3.9.0, 4.0.0 up to 4.1.8 | 3.9.04.1.8 |
What each source reports
OSVDRUPAL-CONTRIB-2026-314No score
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.
Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.
- Record
DRUPAL-CONTRIB-2026-314- Updated
- 2026-11-04
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.