DRUPAL-CONTRIB-2026-013
NoneCVSS
—
EPSS
—
Published
Feb 25, 2026
CISA due date
—
The record
This module integrates the Tagify JavaScript library to enhance taxonomy entity reference widgets. The module does not sufficiently sanitise user-supplied input before rendering it inside JavaScript template strings within the Tagify widget. This allows arbitrary JavaScript execution in the browser when a user creates or edits content.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal/tagify | 0 | 1.2.49 |
Related vulnerabilities
- CVE-2026-3212 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… Same vulnerability
- CVE-2025-13983 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… Also affects drupal/tagify
- DRUPAL-CONTRIB-2025-121 This module enables you to use the Tagify library to enhance text input fields with… Also affects drupal/tagify