CVE-2026-122080 Drupal CVE debrief

Who should care

Defenders responsible for maintaining and securing Drupal sites using the htmLawed module, especially those with SQLite databases and versions of the htmLawed library prior to 1.2.17, should assess exposure and prioritize updating the library to prevent potential XSS attacks.

Why it matters

The htmLawed module for Drupal has a vulnerability that allows bypassing filtering of malicious HTML using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability. Defenders should prioritize verifying and updating the htmLawed library to version 1.2.17 or later, especially for sites using an SQLite database and affected versions of the htmLawed module.

• Potential for cross-site scripting (XSS) attacks
• Exposure of sites using an SQLite database and affected versions of the htmLawed module
• Need for verification and updating of the htmLawed library to version 1.2.17 or later
• Potential impact on site security and data integrity

Technical summary

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability. Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17. The vulnerability can be exploited by using a malformed UTF8 character, which allows an attacker to inject malicious HTML code. The htmLawed library is used to restrict/filter HTML in textual input, and its filtering can be bypassed due to a flaw in handling malformed UTF8 characters. This flaw allows an attacker to inject

Defensive priority

Defenders should prioritize verifying and updating the htmLawed library to version 1.2.17 or later, especially for sites using an SQLite database and affected versions of the htmLawed module.

Recommended defensive actions

• Verify and update the htmLawed library to version 1.2.17 or later
• Assess exposure for sites using an SQLite database and affected versions of the htmLawed module
• Implement compensating controls, such as monitoring and exception tracking, for potential XSS attacks
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is confirmed in the htmLawed module, which enables use of the htmLawed PHP library as a filter in a Text Format for restricting/filtering HTML in textual input. The module's filtering can be bypassed using a malformed UTF8 character, leading to an XSS vulnerability. Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.