Threats tagged 'drupal-contrib-2026-318'

The Texts module for Drupal allows key-based strings and translations, including Twig filters for rendering translated text. A vulnerability exists due to insufficient validation of translation HTML, enabling users with specific permissions to inject JavaScript into pages that display these translations. This requires the attacker to have either the "Create string translation" or "Edit string translation" permission and for the site to use the module's Twig filters to render the affected text. The issue is fixed in version 1.0.17.