DRUPAL-CONTRIB-2020-002
The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them.
This module contains a spamspan twig filter which doesn't sanitize the passed HTML string.
This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter.
What each source reports
OSV No score
The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them.
This module contains a spamspan twig filter which doesn't sanitize the passed HTML string.
This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter.
- Record
DRUPAL-CONTRIB-2020-002- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/spamspanPackagist:https://packages.drupal.org/8 |
1.0.0 to 1.0.0 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2020-002 is a vulnerability with no CVSS score yet in drupal/spamspan, published January 22, 2020. No source lists public exploit code. No source names a fixed version.