CVE-2025-10926 Overview
CVE-2025-10926 is a Cross-Site Scripting (XSS) vulnerability affecting the Drupal JSON Field contributed module. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. Attackers can inject malicious script content that executes in a victim's browser when the affected page is rendered. The issue affects JSON Field versions from 0.0.0 before 1.5. Successful exploitation requires user interaction and results in a scope change, indicating the injected script can affect resources beyond the vulnerable component.
Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions performed under the victim's Drupal session context.
Affected Products
- Drupal JSON Field module versions prior to 1.5
- Drupal sites installing the json_field contributed module
- Any Drupal deployment rendering JSON Field data to authenticated or anonymous users
Discovery Timeline
- 2025-10-30 - CVE-2025-10926 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10926
Vulnerability Analysis
The JSON Field module provides a Drupal field type for storing and displaying JSON-formatted data. The vulnerability arises because the module renders JSON content without adequately sanitizing or encoding output before writing it to the HTML response. When an attacker supplies crafted JSON containing HTML or JavaScript payloads, Drupal emits the payload into the rendered page.
The CVSS vector indicates a network-reachable attack that requires user interaction. Exploitation crosses a trust boundary, meaning injected script executes in the context of the Drupal site regardless of where the payload originated. The confidentiality and integrity impacts are limited but non-trivial, allowing theft of session cookies, CSRF token exfiltration, and forced actions in an authenticated user's session.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The json_field module fails to apply Drupal's standard output escaping, such as the Xss::filter() or Html::escape() helpers, to values pulled from JSON structures before they reach the render pipeline. Field formatters or field widgets in versions prior to 1.5 treat stored JSON content as safe markup, permitting <script> tags and event-handler attributes to survive to the DOM.
Attack Vector
An attacker with permission to submit or edit content containing a JSON Field, or who can influence JSON data ingested from external sources, embeds a script payload inside a JSON value. When a target user views a page rendering that field, the browser executes the payload. The vulnerability requires user interaction, which is satisfied by ordinary page navigation to the affected view.
No verified public exploit code is available. The vulnerability mechanism is described in prose; see the Drupal Security Advisory SA-CONTRIB-2025-106 for vendor technical details.
Detection Methods for CVE-2025-10926
Indicators of Compromise
- Stored JSON Field values containing <script>, javascript:, or DOM event handler attributes such as onerror and onload
- Outbound requests from client browsers to unrecognized domains immediately after rendering pages that display JSON Field content
- Anomalous session cookie or CSRF token access patterns originating from Drupal-rendered pages
Detection Strategies
- Audit Drupal database tables backing json_field storage for payloads matching XSS signatures
- Deploy a web application firewall rule inspecting POST bodies submitted to Drupal node and entity edit endpoints for script tags in JSON payloads
- Enable Content Security Policy (CSP) reporting to identify blocked inline script executions on pages that render JSON Field content
Monitoring Recommendations
- Log and review edits to entities containing JSON Field instances, correlating author accounts with subsequent view events
- Monitor Drupal watchdog logs and reverse proxy access logs for repeated requests targeting URLs known to render JSON Field data
- Alert on browser-side JavaScript errors and CSP violations aggregated to a SIEM for pages hosting the module
How to Mitigate CVE-2025-10926
Immediate Actions Required
- Upgrade the Drupal JSON Field module to version 1.5 or later on all affected sites
- Inventory Drupal installations to identify sites running json_field versions below 1.5 using drush pm:list or the module reports interface
- Review existing JSON Field content for previously stored malicious payloads and sanitize or remove suspicious entries
- Rotate administrator session cookies and API tokens if evidence of exploitation exists
Patch Information
The vendor released a fixed version 1.5 of the JSON Field module. Apply the update via Composer with composer update drupal/json_field or download the release from Drupal.org. Refer to the Drupal Security Advisory SA-CONTRIB-2025-106 for release notes and upgrade instructions.
Workarounds
- Restrict the edit and create permissions on entities containing JSON Field instances to trusted roles until patching completes
- Enforce a strict Content Security Policy that disallows inline scripts and unsafe-eval to blunt XSS payload execution
- Temporarily unpublish or disable views and displays that render JSON Field content on public-facing pages
# Configuration example
composer update drupal/json_field --with-dependencies
drush updatedb
drush cache:rebuild
drush pm:list --filter='name=json_field'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
