Project: 
Tagify
Date: 
2026-February-25
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross-site scripting
Affected versions: 
<1.2.49
CVE IDs: 
CVE-2026-3212
Description: 

This module integrates the Tagify JavaScript library to enhance taxonomy entity reference widgets.

The module does not sufficiently sanitise user-supplied input before rendering it inside JavaScript template strings within the Tagify widget. This allows arbitrary JavaScript execution in the browser when a user creates or edits content.

Solution: 

Install the latest version:

  • If you use the Tagify module, upgrade to Tagify 1.2.49 or later.
Reported By: 
Fixed By: 
Coordinated By: