CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113

Vulnerability

Overview CVE-2025-12083 is a stored cross-site scripting (XSS) vulnerability in the Drupal CivicTheme Design System, affecting versions before 1.12.0 [1]. The root cause is improper neutralization of user-supplied input when rendering field data in Twig templates. CivicTheme components use the Twig raw filter in multiple places, which bypasses automatic escaping and allows unescaped HTML and JavaScript to be injected [2].

Exploitation

Prerequisites An attacker must have permission to create or edit content on a CivicTheme site. By default, only content authors and content approvers have these privileges [2]. The vulnerability can be triggered by inserting malicious scripts into fields that are rendered with the raw filter, or by embedding crafted SVG markup that contains executable JavaScript [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive information. The attack does not require any special network position beyond being able to submit content through the Drupal interface [1][2].

Mitigation

The vulnerability is fixed in CivicTheme version 1.12.0. Users are advised to upgrade immediately. There are no known workarounds, and the advisory notes that the issue is moderately critical [2].