CVE-2025-31682: Drupal Google Tag Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2025-31682: Drupal Google Tag Cross-Site Scripting (XSS) vulnerability. Affects drupal/google_tag across 2 version ranges.
< 1.8.0
>= 2.0.0, < 2.0.8
Fixed in 1.8.0 or 2.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- drupal/google_tag · Packagist:https://packages.drupal.org/8
The same CVE-2025-31682 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Google Tag is a module that integrates Google Tag Manager into Drupal websites, allowing users to manage JavaScript and HTML tags used for tracking and analytics. This module is widely used due to its flexibility and ease of integration with various tracking services. However, it has been found to be vulnerable to a Cross-Site Scripting (XSS) attack, which can compromise the security of websites using this module.
Vulnerability Detail
The vulnerability arises from improper neutralization of user input during web page generation, specifically in the Drupal Google Tag module. This flaw allows attackers to inject malicious scripts into web pages viewed by other users. If successfully exploited, this could lead to unauthorized actions being performed on behalf of users, data theft, or redirection to malicious sites. The affected versions are from 0.0.0 before 1.8.0 and from 2.0.0 before 2.0.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.8.01.8.0composer require drupal/google_tag:1.8.0 -
>= 2.0.0, < 2.0.82.0.8composer require drupal/google_tag:2.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to update immediately, consider disabling the Drupal Google Tag module until a patch can be applied. This will prevent the exploitation of the XSS vulnerability until you can ensure your site is secure.
Conclusion
The Drupal Google Tag module has a critical XSS vulnerability that affects multiple versions. It is essential to update to the latest patched versions to protect your site from potential attacks. If immediate updates are not feasible, consider disabling the module as a temporary workaround.
See every vulnerability recorded for drupal/google_tag →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and site integrity.
You can check if your application is affected by this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Failing to address this vulnerability can lead to data breaches, unauthorized actions on behalf of users, and damage to your site's reputation.
Yes, you can disable the Drupal Google Tag module as a temporary measure to mitigate the risk until you can apply the necessary updates.
Detailed information about this vulnerability can be found in the official advisory on GitHub or through security-focused platforms that track open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/google_tag.
