CVE-2026-122078

The Extended HTML Filter module allows using style attributes in CKEditor.

The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.