PatchClock

PHP security digest · 21 Oct 2026

This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passe...

Unrated CVE-2026-114536

Package
drupal/uswds_paragraph_components
Fixed in
3.1.3
Published
Wed 21 Oct 2026, 18:47 Lisbon

In plain words

The module's Twig templates do not sufficiently sanitise values passed into their markup. An attacker must have a role that allows them to edit content using the module's paragraph bundles to take advantage of this flaw.

Am I affected?

Find drupal/uswds_paragraph_components and its version in composer.lock. The advisory lists 3.1.3 as fixed but gives no affected version range. Check whether any roles allow users to edit content using the module's paragraph bundles.

What to do

Check which version you have, then update to a fixed release for your branch (3.1.3):

composer show drupal/uswds_paragraph_components | grep versions
composer update drupal/uswds_paragraph_components

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by the requirement that an attacker have a role allowing them to edit content using the module's paragraph bundles.

The advisory's description

This module provides a suite of Paragraphs bundles that works within the USWDS framework.

The module's twig templates do not sufficiently sanitize values passed to its markup.

This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph bundles provided by the module.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.