—
DRUPAL-CONTRIB-2023-044
Details
The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page.
The abbr\_class Twig filter can be used to bypass the Twig auto-escape feature.
This vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/webprofiler
Introduced in:
10.1.0Fixed in: 10.1.1Upgrade drupal/webprofiler to 10.1.1 or newer (ecosystem packagist:https://packages.drupal.org/8).