{"id":"DRUPAL-CONTRIB-2024-002","aliases":["CVE-2024-13238"],"title":"DRUPAL-CONTRIB-2024-002","description":"The Typogrify module brings the typographic refinements of Typogrify to Drupal. It provides a text filter and a Twig filter.\n\nThe typogrify Twig filter can be used to bypass the Twig auto-escape feature, leading to a persistent Cross Site Scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that it is only exposed when the twig filter is specifically used in a template to render content.","severity":"unknown","score":null,"published":"2024-01-10T18:00:05.000Z","modified":"2026-09-10T03:46:05.836Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/typogrify","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.0"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<1.3.0"}}],"versions":[],"fixed":["1.3.0"]}],"references":["https://www.drupal.org/sa-contrib-2024-002"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2024-002","modified":"2026-09-10T03:46:05.836403600Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2024-002"}],"assessments":[]}