CVE-2025-11570

Vulnerability

Overview

The package drupal-pattern-lab/unified-twig-extensions is vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data. The vulnerability affects all versions from 0.0.0. The root cause is that the package does not properly sanitize user-supplied input when rendering Twig templates, allowing an attacker to inject arbitrary HTML or JavaScript [1][2].

Exploitation

Conditions

This vulnerability is exploitable only when the code is executed outside of Drupal. The package is intended to share custom Twig extensions between Drupal and Pattern Lab, and the vulnerable function is only exposed when used in a non-Drupal context [1][2]. A proof-of-concept demonstrates that the link() function can be abused with a payload like {{ link('', 'bar', '') }} to trigger XSS [2].

Impact

An attacker who can control input passed to the vulnerable Twig function can execute arbitrary JavaScript in the context of the victim's browser. This could lead to session hijacking, defacement, or theft of sensitive information. The CVSS v3 base score 4.6 (Medium) [1].

Mitigation

Status

The original package is unmaintained. The fix is available in version 1.1.1 of the forked package drupal/unified_twig_ext hosted on Drupal.org [1][4]. Users are advised to migrate to the maintained fork to remediate the vulnerability.