Project: 
htmLawed
Project machine name: 
htmlawed
Date: 
2026-November-04
Security risk: 
Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: 
Cross-site scripting
Affected versions: 
>=3.0.0 <3.9.0 || >=4.0.0 <4.1.8
CVE IDs: 
CVE-2026-122080
Description: 

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.

The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.

Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.

Solution: 

Install the latest version:

  • If you use version 4.1.x, upgrade to 4.1.11 (was fixed in 4.1.8).
  • If you use version 8.x-3.x, upgrade to 8.x-3.10 (was fixed in 8.x-3.9).

Alternately, replace the htmLawed.php and htmLawed_README.htm files in the module directory with new downloads for htmLawed library version >= 1.2.17.

Reported By: 
Fixed By: 
Coordinated By: