CVE-2025-13984: Kanopi Next.js XSS Vulnerability

CVE-2025-13984 Overview

CVE-2025-13984 is a Cross-Site Scripting (XSS) vulnerability in the Kanopi Next.js module for Drupal. The flaw stems from a permissive cross-domain security policy that trusts untrusted domains [CWE-942]. Attackers can leverage this misconfiguration to execute arbitrary script content in the context of a victim's browser session.

The issue affects Next.Js versions from 0.0.0 before 1.6.4, and from 2.0.0 before 2.0.1. Exploitation requires user interaction, and the attack can be delivered over the network without authentication.

Critical Impact
Successful exploitation enables Cross-Site Scripting against Drupal sites running the Kanopi Next.js integration module, allowing script execution across security scopes.

Affected Products

Kanopi Next.js module for Drupal versions 0.0.0 to 1.6.4 (exclusive)
Kanopi Next.js module for Drupal versions 2.0.0 to 2.0.1 (exclusive)
Drupal sites integrating the Next.js contrib module

Discovery Timeline

2026-01-28 - CVE-2025-13984 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13984

Vulnerability Analysis

The vulnerability resides in the Kanopi Next.js contrib module, which bridges Drupal backends with Next.js frontends. The module configures a cross-domain security policy that includes untrusted or overly broad domain entries. This permissive configuration weakens the browser's same-origin protections between the Drupal application and external origins.

When a browser trusts responses or resources from untrusted domains, an attacker can inject script content that executes within the trusted application scope. The Common Weakness Enumeration classifies this pattern as [CWE-942] Permissive Cross-domain Policy with Untrusted Domains. The scope change indicator in the vulnerability metrics reflects impact reaching beyond the vulnerable component into the user's browser context.

Root Cause

The module's cross-origin resource sharing or cross-domain policy configuration accepts entries that expand trust to origins not under the site operator's control. Any script served from those origins, or reflected content from an attacker-influenced source, executes with the privileges of the Drupal site.

Attack Vector

An attacker crafts a malicious link or hosts attacker-controlled content on a domain permitted by the misconfigured policy. When an authenticated Drupal user interacts with the crafted content, the browser executes attacker-supplied JavaScript in the context of the Drupal site. This enables session token theft, unauthorized actions on behalf of the user, defacement, and phishing pivots. Refer to the Drupal Security Advisory for vendor-specific details.

Detection Methods for CVE-2025-13984

Indicators of Compromise

Unexpected outbound requests from browsers to domains listed in the Next.js module cross-domain configuration.
Drupal access logs showing referer headers or callbacks originating from untrusted third-party domains.
Session anomalies such as authenticated actions performed from unusual client fingerprints following user link clicks.

Detection Strategies

Audit the Next.js module configuration for crossorigin, CORS, and cross-domain policy entries that include wildcards or unverified third-party hosts.
Inspect rendered HTML and HTTP response headers for Access-Control-Allow-Origin values that reflect arbitrary origins.
Review Drupal watchdog and web server logs for repeated requests targeting Next.js preview or revalidation endpoints.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script executions from unexpected origins.
Monitor for JavaScript errors or console violations indicating blocked cross-origin script activity on Drupal pages.
Alert on modifications to the Next.js module configuration files and permission changes in Drupal administrative logs.

How to Mitigate CVE-2025-13984

Immediate Actions Required

Upgrade the Kanopi Next.js module to version 1.6.4 or later on the 1.x branch, or 2.0.1 or later on the 2.x branch.
Review site cross-domain and CORS configuration and remove any wildcard or untrusted domain entries.
Rotate active Drupal session tokens and API keys used by the Next.js frontend after patching.

Patch Information

Kanopi has released fixed versions 1.6.4 and 2.0.1 addressing the permissive cross-domain policy. Full remediation details are available in the Drupal Security Advisory SA-CONTRIB-2025-122.

Workarounds

Restrict Access-Control-Allow-Origin at the reverse proxy or web server to an explicit allowlist of trusted frontend hosts.
Deploy a strict Content Security Policy limiting script-src and connect-src directives to known origins.
Temporarily disable the Next.js module on affected Drupal sites until the patched version can be deployed.

bash

# Configuration example: update the Next.js module via Composer
composer require 'drupal/next:^2.0.1'
drush updatedb -y
drush cache:rebuild