# CVE-2026-126741: Drupal Smart Trim cross-site scripting in Twig filter

Source: https://junglewise.ai/threats/cve-2026-126741-drupal-contrib-2026-332-this-module-implements-a-field-formatter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-126741 · Severity: info · Published 2026-11-11

Smart Trim is a Drupal module that provides an improved text field formatter. The module fails to properly escape HTML in its Twig filter, allowing attackers with content creation permissions to inject malicious scripts that execute in users' browsers. This vulnerability only affects sites using the module's Twig filter; sites using only the field formatter are unaffected.

Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-126741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126741 being exploited in the wild.

**How severe is CVE-2026-126741?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Drupal Smart Trim all versions before 2.2.2, and versions 2.3.0 before 2.3.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Smart Trim ECOSYSTEM:introduced=0,fixed=2.2.2|ECOSYSTEM:introduced=2.3.0,fixed=2.3.2.

**Is there a fix for CVE-2026-126741?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Smart Trim: upgrade to 2.2.2 or later. Until then: If a site uses only the Smart Trim field formatter without the Twig filter, the vulnerability does not apply. Alternatively, restrict content creation permissions to trusted users until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126741 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126741?** Check whether you run Drupal Smart Trim or Packagist:Https://Packages.Drupal.Org/8 Drupal/Smart Trim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Smart Trim: upgrade to 2.2.2 or later

If a site uses only the Smart Trim field formatter without the Twig filter, the vulnerability does not apply. Alternatively, restrict content creation permissions to trusted users until upgrading.

## Technical details

The Smart Trim module implements Twig filters (smart_trim_*) that do not sufficiently escape unsafe HTML input. An authenticated attacker with a role permitted to post content that passes through these filters can inject arbitrary HTML and JavaScript. The vulnerability requires the attacker to have content creation permissions and the vulnerable Twig filter to be actively used in the site's templates.

## Affected products

- Drupal Smart Trim all versions before 2.2.2, and versions 2.3.0 before 2.3.2

## Identifiers

- CVE-2026-126741
- DRUPAL-CONTRIB-2026-332

## Timeline

- 2026-11-11: disclosed

## References

- [https://www.drupal.org/u/prudloff](https://www.drupal.org/u/prudloff)
- [https://www.drupal.org/sa-contrib-2026-332](https://www.drupal.org/sa-contrib-2026-332)

## Related threats

- [DRUPAL-CONTRIB-2019-092 - The Smart Trim module allows site builders additional control with text summary fields. The…](https://junglewise.ai/threats/drupal-contrib-2019-092-the-smart-trim-module-allows-site-builders-d884f48c)