CVE-2025-31675
2 advisories.
Packagist/drupal/core CVE-2025-31675: unknown
Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability (XSS).
Action: Upgrade drupal/core to 10.3.14 or later.
composer require drupal/core:10.3.14composer require drupal/core:10.4.5composer require drupal/core:11.0.13composer require drupal/core:11.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 10.3.14 | - |
| 10.4.0 | 10.4.5 | - |
| 11.0.0 | 11.0.13 | - |
| 11.1.0 | 11.1.5 | - |
Fixed versions
| 10.3.14 | 10.4.5 | 11.0.13 | 11.1.5 |
Sources
CVE-2025-31675 · published · modified · JSON
Packagist/drupal/core CVE-2025-31675: medium 5.4
Drupal Core Cross-Site Scripting (XSS) Vulnerability
Action: Upgrade drupal/core to 10.3.14 or later.
composer require drupal/core:10.3.14composer require drupal/core:10.4.5composer require drupal/core:11.0.13composer require drupal/core:11.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 10.3.14 | - |
| 10.4.0 | 10.4.5 | - |
| 11.0.0 | 11.0.13 | - |
| 11.1.0 | 11.1.5 | - |
Fixed versions
| 10.3.14 | 10.4.5 | 11.0.13 | 11.1.5 |
Sources
- osv: GHSA-m4wj-hhwj-47qp
- https://nvd.nist.gov/vuln/detail/CVE-2025-31675
- https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004
- https://github.com/drupal/core
- https://www.drupal.org/sa-core-2025-004
- https://www.herodevs.com/vulnerability-directory/cve-2025-31675
CVE-2025-31675 · published · modified · JSON