Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-126741
Published:November 11, 2026
Updated:November 12, 2026
This module implements a field formatter for text fields that improves the Summary or Trimmed formatter built into Drupal core. The module doesn't sufficiently escape unsafe HTML when passed through the module's Twig filter. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to post content that gets passed through a Twig template with one of the "|smart_trim_*" filters provided by this module. If a site uses only use the field formatter without the Twig filter, it is not vulnerable.
Affected Packages
https://git.drupalcode.org/project/smart_trim.git (SCM_GIT):
Affected version(s) >=2.3.0 <2.3.2
Fix Suggestion:
Update to version 2.3.2
https://git.drupalcode.org/project/smart_trim.git (SCM_GIT):
Affected version(s) >=2.1.1 <2.2.2
Fix Suggestion:
Update to version 2.2.2
Do you need more information?
Contact Us
CVSS v4
Base Score:
2.1
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation