SpamSpan filter - Moderately critical - Cross site scripting - SA-CONTRIB-2020-002

Project: SpamSpan filterDate: 2020-January-22Security risk: Moderately critical 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross site scriptingDescription: The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them.
This module contains a spamspan twig filter which doesn't sanitize the passed HTML string.
This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter.
Solution: Install the latest version:

Also see the SpamSpan filter project page.Reported By: 

Fixed By: 

Coordinated By: 

Path to article