DRUPAL-CONTRIB-2023-044
The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page.
The abbr_class Twig filter can be used to bypass the Twig auto-escape feature.
This vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector.
What each source reports
OSVNo score
The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page.
The abbr_class Twig filter can be used to bypass the Twig auto-escape feature.
This vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector.
- Record
DRUPAL-CONTRIB-2023-044- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/webprofilerPackagist:https://packages.drupal.org/8 | 10.1.0 up to 10.1.1 | 10.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-044 is a vulnerability with no CVSS score yet in drupal/webprofiler, published September 6, 2023. No source lists public exploit code. Fixed in drupal/webprofiler 10.1.1.