CVE-2026-122080 json
The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php) PHP library…
published 2026-11-04 4 d ago modified 2026-11-04 4 d ago also DRUPAL-CONTRIB-2026-314
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php) PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.
The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.
Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.
Patch / fix
- packagist drupal/htmlawed 3.9.0, 4.1.8
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | drupal/htmlawed | >=3.0.0, <3.9.0 >=4.0.0, <4.1.8 |
3.9.0 4.1.8 |
References
Sources
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.