CVE-2025-31675

Vulnerability

Details

A cross-site scripting (XSS) vulnerability exists in Drupal core's Link field due to insufficient sanitization of attributes during web page generation [2][4]. The improper neutralization of input allows attackers to inject malicious scripts that are stored and executed in the context of other users' browsers [3].

Exploitation

Exploitation requires the ability to add specific attributes to a Link field, which typically necessitates edit permissions via core web services, REST APIs, or custom/contrib modules [2][4]. The vulnerability is stored, meaning the malicious payload persists and triggers when the link is rendered.

Impact

Successful exploitation can lead to session hijacking, data theft, malware distribution, defacement, or privilege escalation within the context of the affected site [2].

Mitigation

Drupal core has been patched in versions 10.3.14, 10.4.5, 11.0.13, and 11.1.5 [4]. For Drupal 7, the affected Link module versions 7.x-1.0 through 7.x-1.12 are patched in Link NES 7.1.14 [2][3]. Sites that disable the Link module or do not use link fields are not affected [4].