This module enables you to add HTML attributes to menu links and their container elements (`<li>`). The module doesn't sufficiently sanitize the attributes it...

The module does not sufficiently sanitise HTML attributes applied to menu link container elements (<li>), allowing an attacker to apply unsafe attributes. The attacker must have both “Administer menus and menu links” and “Use menu link attributes” permissions, and an unsafe container attribute must already have been configured by someone with “Administer menu link attributes” permission. The default configuration is not affected.

Look for drupal/menu_link_attributes and its version in composer.lock. The advisory lists 1.8.0 as fixed but gives no affected version range. Check whether an unsafe container attribute has been configured and whether any role has both “Administer menus and menu links” and “Use menu link attributes” permissions.

The advisory identifies the default configuration and the required permissions as mitigating factors, but gives no specific workaround steps.

This module enables you to add HTML attributes to menu links and their container elements (<li>).

The module doesn't sufficiently sanitize the attributes it applies to menu link container elements.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "Administer menus and menu links" and "Use menu link attributes". In addition, an unsafe container attribute must already be configured by a user with the restricted permission "Administer menu link attributes". The default configuration is not affected.