CVE-2025-31675 Overview
CVE-2025-31675 is a Cross-Site Scripting (XSS) vulnerability in Drupal core caused by improper neutralization of input during web page generation [CWE-79]. The flaw allows attackers with limited privileges to inject malicious script content that executes in the context of other users' browsers. Exploitation requires user interaction and crosses a security boundary, expanding the scope of impact. The vulnerability affects multiple supported branches of Drupal core and the Drupal 7 Link module. Drupal published advisory SA-CORE-2025-004 to address the issue.
Critical Impact
Authenticated attackers can inject script content that executes in victim browsers, enabling session theft, credential harvesting, and unauthorized actions performed under the victim's identity.
Affected Products
- Drupal core 8.0.0 before 10.3.14
- Drupal core 10.4.0 before 10.4.5, 11.0.0 before 11.0.13, and 11.1.0 before 11.1.5
- Drupal 7 Link module versions 7.x-1.0 through 7.x-1.12
Discovery Timeline
- 2025-03-31 - CVE-2025-31675 published to NVD
- 2026-04-02 - Last updated in NVD database
Technical Details for CVE-2025-31675
Vulnerability Analysis
The vulnerability resides in the handling of link-related input within Drupal core and the Drupal 7 Link module. User-supplied content passed through link fields is not adequately sanitized before being rendered in HTML output. An attacker with permission to create or edit content containing link data can embed crafted payloads that bypass output filtering. When another user views the affected page, the browser interprets the payload as executable script.
The scope is marked as changed because the injected script runs in the trust context of the Drupal site rather than the attacker's own boundary. This enables session token exposure, form manipulation, and pivoting toward administrative actions when the victim holds elevated privileges. The attack vector is network-based, requires low privileges, and depends on user interaction such as visiting the rendered page.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. Output rendering paths for link content fail to escape or strip script-bearing markup, allowing attacker-controlled HTML attributes or text to be reflected into the DOM. Refer to the Drupal Security Advisory and Tag1 Security Advisory for component-level technical details.
Attack Vector
An authenticated attacker with content creation rights crafts a link field value containing JavaScript-bearing markup. The malicious value is stored and later served to other site users when they navigate to pages referencing the link. Execution occurs in the victim's browser under the origin of the Drupal site, leading to confidentiality and integrity impact on user sessions.
No verified public proof-of-concept code is available for this vulnerability. See the HeroDevs CVE-2025-31675 entry for additional context.
Detection Methods for CVE-2025-31675
Indicators of Compromise
- Stored content in node, field_data_*, or link field tables containing <script>, javascript:, or event handler attributes such as onerror= and onload=.
- Web server access logs showing repeated edit or save requests to link-bearing content types by low-privilege accounts.
- Outbound requests from user browsers to attacker-controlled domains shortly after rendering affected pages.
Detection Strategies
- Audit Drupal database fields holding link URLs and titles for HTML control characters and script-related tokens.
- Deploy Content Security Policy (CSP) reporting endpoints to capture script-src violations originating from rendered link fields.
- Correlate authenticated content edits with subsequent anomalous JavaScript execution events flagged by browser or proxy telemetry.
Monitoring Recommendations
- Enable Drupal dblog and syslog modules to track content modifications, focusing on accounts with link-field permissions.
- Forward web server and application logs to a centralized SIEM for retention and correlation with authentication events.
- Alert on administrative session activity originating from unusual IP addresses immediately after public content views.
How to Mitigate CVE-2025-31675
Immediate Actions Required
- Upgrade Drupal core to 10.3.14, 10.4.5, 11.0.13, or 11.1.5 as appropriate for the deployed branch.
- Update the Drupal 7 Link module to a fixed release published under advisory SA-CORE-2025-004.
- Review user accounts with content creation and link-field permissions and revoke unnecessary access.
Patch Information
Drupal published fixes through advisory SA-CORE-2025-004. Site operators should apply the corresponding minor release for their branch and rebuild caches after upgrade. Drupal 7 is end-of-life; the Link module fix is distributed through extended support providers referenced in the advisory.
Workarounds
- Restrict permissions for creating and editing content types that expose link fields to trusted roles only.
- Apply a strict Content Security Policy that disallows inline scripts and limits script sources to known origins.
- Sanitize existing stored link field content by running database review queries to identify and remediate suspicious markup before patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
