{"action":"Upgrade drupal/core to 10.3.14 or later.","affected":[{"fixed":"10.3.14","introduced":"8.0.0"},{"fixed":"10.4.5","introduced":"10.4.0"},{"fixed":"11.0.13","introduced":"11.0.0"},{"fixed":"11.1.5","introduced":"11.1.0"}],"component":"drupal/core","cve_ids":["CVE-2025-31675"],"ecosystem":"Packagist","epss":0.00502,"exploited":false,"fixed_versions":["10.3.14","10.4.5","11.0.13","11.1.5"],"ghsa_id":"GHSA-m4wj-hhwj-47qp","id":"tcs_01M5KF54YWNJHA58SSYRS0FW8J","modified_at":"2026-04-06T17:46:18.151624Z","published_at":"2025-04-01T00:30:33Z","references":["https://osv.dev/vulnerability/GHSA-m4wj-hhwj-47qp","https://nvd.nist.gov/vuln/detail/CVE-2025-31675","https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004","https://github.com/drupal/core","https://www.drupal.org/sa-core-2025-004","https://www.herodevs.com/vulnerability-directory/cve-2025-31675"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-m4wj-hhwj-47qp","url":"https://osv.dev/vulnerability/GHSA-m4wj-hhwj-47qp"}],"summary":"Drupal Core Cross-Site Scripting (XSS) Vulnerability"}