{ "canonical_id": "drupal--a141e2f71d", "system_id": "drupal", "display_name": "Drupal", "category": "cms", "advisory_mode": "core", "title": "Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004", "summary": "
Project: 
Drupal core
Date: 
2025-March-19
Security risk: 
Moderately critical 13\u2009\u2215\u200925 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross Site Scripting
Affected versions: 
>= 8.0.0 < 10.3.14 || >= 10.4.0 < 10.4.5 || >= 11.0.0 < 11.0.13 || >= 11.1.0 < 11.1.5
CVE IDs: 
CVE-2025-31675
Description: 

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability (XSS).

\n

This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit access via core web services, or a contrib or custom module.

\n

Sites with the Link module disabled or that do not use any link fields are not affected.

Solution: 

Install the latest version:

\n\n

All versions of Drupal prior to 10.3 are end-of-life and do not receive security coverage from the Drupal Security Team.

Reported By: 
Fixed By: 
", "published_at": "Wed, 19 Mar 2025 18:54:35 +0000", "updated_at": "Wed, 19 Mar 2025 18:54:35 +0000", "severity": "unknown", "cvss_score": null, "exploit_status": "unknown", "source_confidence": "official", "official_source_url": "https://www.drupal.org/sa-core-2025-004", "secondary_source_urls": [], "aliases": [], "cve_ids": [], "ghsa_ids": [], "osv_ids": [], "affected_versions": [], "fixed_versions": [], "package_name": null, "render_markdown": false, "case_path": null, "secure_code_topics": [ "authz-server-side-recheck", "xss-output-encoding", "file-upload-validation", "plugin-extension-trust-policy" ], "status": "triage", "triage_reasons": [ "missing affected/fixed version details" ], "verification_status": "triage-manual", "verification_mode": "synthetic", "last_verified_at": null, "last_run_id": null, "evidence_bundle": null, "historical_status": null, "latest_status": null, "browser_evidence": { "required": false, "present": false, "refs": [] }, "repro_profile_id": "xss-generic", "artifact_mode": "official-image", "blocked_reason": null, "metadata": { "source_names": [ "Drupal Security Advisories RSS" ], "source_kinds": [ "rss-feed" ], "candidate_count": 1 } }