Project:
Project machine name:
uswds_paragraph_componentsDate:
2026-October-21
Vulnerability:
Cross site scripting
Affected versions:
<3.1.3
CVE IDs:
CVE-2026-114536
Description:
This module provides a suite of Paragraphs bundles that works within the USWDS framework.
The module's twig templates do not sufficiently sanitize values passed to its markup.
This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph bundles provided by the module.
Solution:
Install the latest version:
- If you use the USWDS Paragraph Components, upgrade to USWDS Paragraph Components 3.1.3
Reported By:
- Hemant Gupta (guptahemant)
- Lee Rowlands (larowlan) of the Drupal Security Team
Fixed By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
