CVE-2026-11908: Cross-Site Scripting Vulnerability in Drupal Tagify Package
Summary
CVE-2026-11908: This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets. Affects drupal/tagify versions < 1.2.52. Fixed in 1.2.52. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Tagify module for Drupal enhances entity reference selection in entity reference widgets by integrating the Tagify JavaScript library. It allows users to easily manage and select taxonomy terms, improving the overall user experience. However, this module has a critical vulnerability that can be exploited if not addressed promptly.
Vulnerability Detail
The vulnerability arises from the module's failure to properly sanitize the names of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This oversight can lead to a cross-site scripting (XSS) vulnerability, allowing attackers to execute arbitrary JavaScript in the context of a user's session. The risk is heightened for users with roles that permit the creation or editing of taxonomy terms, as they can potentially exploit this flaw to inject malicious scripts.
How To Fix
Minimum fixed version
1.2.52
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict user roles that have permissions to create or edit taxonomy terms until the module is updated. This can help minimize the risk of exploitation while a permanent fix is applied.
Conclusion
The CVE-2026-11908 vulnerability in the Drupal Tagify module poses a significant risk due to its potential for cross-site scripting attacks. It is crucial for users to update to the patched version to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/tagify →
FAQ
CVE-2026-11908 is a cross-site scripting vulnerability in the Drupal Tagify module that allows attackers to execute arbitrary JavaScript in a user's session.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the Tagify module to version 1.2.52 or later using Composer with the command: 'composer require drupal/tagify:^1.2.52'.
The vulnerability can lead to unauthorized execution of JavaScript, potentially compromising user sessions and sensitive data.
Yes, temporarily restrict user roles that can create or edit taxonomy terms until the module is updated to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/tagify.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
