drupal/cookies · Cookies: This module enables you to manage user consent for external services, such as embedded videos
Affects drupal/cookiesSource GCVE Database
Rated Medium by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.2.17
Data as of 11 Nov 2026, 20:05 UTC
What to do
Upgrade drupal/cookies to 1.2.17.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagist https //packages.drupal.org/8drupal/cookies | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade the Drupal Cookies module to version 1.2.17 or later, where this vulnerability is fixed. No additional mitigation is required as the fix addresses the insufficient validation issue.
Description
The Drupal Cookies module has a vulnerability in its Video submodule where it insufficiently validates the 'data-cookies-video-blazy-src' attribute before converting it back to a 'src' attribute for Blazy iframes. This flaw could allow an attacker with specific permissions to inject content that affects all users. The vulnerability is fixed in version 1.2.17.