CVE-2026-122068 Drupal CVE debrief

Who should care

Defenders responsible for maintaining and securing Drupal installations that use the highlight_js module should assess exposure and apply patches as necessary. This includes reviewing version numbers and updating to 1.3.1 or later if necessary.

Why it matters

A reflected XSS vulnerability in the drupal/highlight_js module requires defenders to verify exposure, apply patches, and implement additional security measures to prevent exploitation and potential attacks.

• Defenders must verify exposure and apply patches to prevent exploitation.
• Security teams should review and validate user input to the CKEditor 5 preview endpoint.
• Incident response teams may need to investigate and respond to potential XSS attacks.

Technical summary

The drupal/highlight_js module allows adding syntax-highlighted code snippets to content using CKEditor 5. However, the module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers to inject malicious scripts into the application.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for the drupal/highlight_js module, particularly for versions less than 1.3.1.

Recommended defensive actions

• Verify the version of the drupal/highlight_js module and update to 1.3.1 or later if necessary.
• Review and validate user input to the CKEditor 5 preview endpoint.
• Implement additional security measures to detect and prevent XSS attacks.

Evidence notes

The vulnerability was reported in the drupal/highlight_js module, which allows adding syntax-highlighted code snippets using CKEditor 5. The module's insufficient input validation in the CKEditor 5 preview endpoint leads to a reflected XSS vulnerability. Affected versions are less than 1.3.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.