Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

Vulnerability

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in Drupal core, stemming from improper neutralization of user input during web page generation [2]. According to the Drupal security advisory, the core software does not sufficiently filter error messages under certain circumstances, leading to the XSS flaw [3].

Exploitation

An attacker can exploit this by crafting a malicious link that triggers a specially constructed error message, causing the Drupal site to reflect arbitrary JavaScript code in the response. No authentication is explicitly required; the attack is remote and can be delivered via a crafted URL, though Drupal's advisory notes that exploit details may become public soon [3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, content injection, or defacement, potentially compromising user data and the integrity of the Drupal site [3].

Mitigation

Drupal has released patched versions: 10.3.13, 10.4.3, 11.0.12, and 11.1.3 [3]. Sites using Drupal Steward are protected, but upgrading is strongly recommended. Drupal versions before 10.3 are end-of-life and no longer receive security coverage [3].