Packagist/drupal/core CVE-2025-31675: medium 5.4, EPSS 0.50%
Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability (XSS).
Action: Upgrade drupal/core to 10.3.14 or later.
composer require drupal/core:10.3.14composer require drupal/core:10.4.5composer require drupal/core:11.0.13composer require drupal/core:11.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 10.3.14 | - |
| 10.4.0 | 10.4.5 | - |
| 11.0.0 | 11.0.13 | - |
| 11.1.0 | 11.1.5 | - |
Fixed versions
| 10.3.14 | 10.4.5 | 11.0.13 | 11.1.5 |
Sources
CVE-2025-31675 · published · modified · JSON