JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106

Vulnerability

Overview

The JSON Field module for Drupal, which allows storage and display of JSON data via optional third-party libraries, contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. The module does not sufficiently filter data when using certain included field formatters, allowing malicious content to be rendered unsanitized [2].

Exploitation

An attacker with the ability to input or modify JSON field content can inject arbitrary JavaScript or HTML. When other users view the affected field formatter output, the injected script executes in their browser session. No special privileges beyond content creation or editing are required, depending on the site's permissions configuration [2].

Impact

Successful exploitation leads to stored XSS, enabling an attacker to perform actions on behalf of the victim, steal session cookies, redirect users to malicious sites, or deface pages. The vulnerability affects all versions of the JSON Field module from 0.0.0 up to, but not including, version 1.5 [1][2].

Mitigation

The Drupal security advisory (SA-CONTRIB-2025-106) recommends upgrading to JSON Field 8.x-1.5 or later, which contains the necessary input sanitization fixes [2]. No workarounds are documented; applying the update is the only confirmed mitigation.