CVE-2025-9550: Drupal Facets XSS Vulnerability

CVE-2025-9550 Overview

CVE-2025-9550 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Facets module. The flaw stems from improper neutralization of input during web page generation [CWE-79]. Attackers can inject malicious script content that executes in the browser of users viewing affected faceted search pages. The issue affects Facets versions prior to 2.0.10 and versions from 3.0.0 before 3.0.1. Successful exploitation requires user interaction and can lead to session compromise, credential theft, or unauthorized actions performed in the context of the victim.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session hijacking, phishing overlays, and cross-site actions on Drupal sites using the vulnerable Facets module.

Affected Products

Drupal Facets module versions 0.0.0 through 2.0.9
Drupal Facets module versions 3.0.0 (before 3.0.1)
Drupal sites using the Facets contributed module for faceted search

Discovery Timeline

2025-10-10 - CVE-2025-9550 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9550

Vulnerability Analysis

The Facets module provides faceted search functionality for Drupal sites, generating filter widgets from search results. The vulnerability results from insufficient output encoding when rendering facet values or related user-controllable input into HTML responses. When an attacker supplies input containing HTML or JavaScript payloads that reaches the affected rendering path, the payload is reflected without proper sanitization.

The attack surface is exposed through URL parameters or content that flows into facet rendering. Because the scope is marked as changed, script execution can affect resources beyond the vulnerable component, including authenticated administrative sessions on the same origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Facets module does not consistently apply Drupal's rendering safeguards, such as auto-escaping via Twig or the Html::escape() API, on all input paths before emitting HTML. Values that should be treated as plain text are rendered as markup, allowing embedded <script> tags or event handler attributes to execute.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL containing a malicious payload targeting a facet parameter and delivers it through phishing, forum posts, or third-party referrers. When a victim opens the link on a vulnerable Drupal site, the injected script executes in the victim's browser under the site's origin. See the Drupal Security Advisory SA-CONTRIB-2025-100 for vendor-provided technical details.

No public proof-of-concept exploit is currently listed for CVE-2025-9550, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-9550

Indicators of Compromise

HTTP request logs containing <script>, onerror=, onload=, or javascript: sequences within facet-related query parameters
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting faceted search pages
Drupal watchdog entries showing unusual facet parameter values or malformed URL-encoded payloads
Reports from users of unexpected popups, redirects, or credential prompts on faceted search result pages

Detection Strategies

Inspect web server access logs for facet URL parameters containing HTML tags, JavaScript scheme URIs, or common XSS payload patterns.
Enable a strict Content Security Policy (CSP) in report-only mode to surface inline script violations originating from facet-rendered pages.
Run authenticated Drupal security scans, such as drush pm:security and DAST tooling, against pages using the Facets module.
Review the installed Facets module version with drush pm:list --status=enabled | grep facets and compare against fixed releases 2.0.10 and 3.0.1.

Monitoring Recommendations

Alert on web application firewall (WAF) rules matching reflected XSS signatures on URLs that include facet query parameters.
Monitor Drupal error logs for Twig rendering warnings and unusual entity access patterns tied to facet requests.
Track anomalous session activity, including new admin logins from unexpected IP addresses, following exposure to untrusted referrers.

How to Mitigate CVE-2025-9550

Immediate Actions Required

Upgrade the Facets module to version 2.0.10 for the 2.x branch or 3.0.1 for the 3.x branch immediately.
Clear the Drupal cache with drush cache:rebuild after upgrading to ensure updated rendering logic is applied.
Audit recent web server logs for suspicious facet parameter payloads that predate the upgrade.
Rotate administrative session tokens and force re-authentication if exploitation is suspected.

Patch Information

Drupal released fixed versions of the Facets module addressing CVE-2025-9550. Site administrators should install Facets 2.0.10 or 3.0.1 from the official Drupal project page. Full remediation details are available in the Drupal Security Advisory SA-CONTRIB-2025-100.

Workarounds

Temporarily disable the Facets module using drush pm:uninstall facets if immediate patching is not feasible.
Restrict access to faceted search pages to authenticated users through Drupal's permission system until the patch is applied.
Deploy a WAF rule to block requests containing HTML tags or JavaScript keywords in facet query parameters.
Enforce a Content Security Policy that disallows inline scripts to reduce the impact of reflected XSS payloads.

bash

# Configuration example: upgrade Facets module via Composer and Drush
composer require 'drupal/facets:^2.0.10'
# or for the 3.x branch:
composer require 'drupal/facets:^3.0.1'

# Apply database updates and clear caches
drush updatedb -y
drush cache:rebuild

# Verify installed version
drush pm:list --status=enabled --filter=facets