—
DRUPAL-CONTRIB-2026-013
Details
This module integrates the Tagify JavaScript library to enhance taxonomy entity reference widgets.
The module does not sufficiently sanitise user-supplied input before rendering it inside JavaScript template strings within the Tagify widget. This allows arbitrary JavaScript execution in the browser when a user creates or edits content.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/tagify
Introduced in:
0Fixed in: 1.2.49Upgrade drupal/tagify to 1.2.49 or newer (ecosystem packagist:https://packages.drupal.org/8).