CVE-2025-31695: Drupal Link Field Display Mode Formatter XSS Vulnerability
Summary
CVE-2025-31695: Drupal Link field display mode formatter Cross-Site Scripting (XSS) vulnerability. Affects drupal/link_field_display_mode_formatter versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Link Field Display Mode Formatter is a component of the Drupal content management system that allows users to create and manage links within their content. This package is essential for displaying links in various formats, enhancing the user experience by providing flexible link management options. However, it is susceptible to a Cross-Site Scripting (XSS) vulnerability, which can lead to security risks if not addressed promptly.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by other users. This XSS vulnerability can lead to unauthorized actions being performed on behalf of users, data theft, or other malicious activities. It affects versions of the Link Field Display Mode Formatter prior to 1.6.0, making it critical for users of affected versions to take immediate action.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
composer require drupal/link_field_display_mode_formatter:1.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider sanitizing user input and escaping output in your application to mitigate the risk of XSS attacks. Implementing Content Security Policy (CSP) headers can also help reduce the impact of potential XSS vulnerabilities.
Conclusion
The Drupal Link Field Display Mode Formatter has a critical XSS vulnerability that can compromise the security of applications using it. It is essential to update to version 1.6.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help developers monitor vulnerabilities effectively.
See every vulnerability recorded for drupal/link_field_display_mode_formatter →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failure to address this vulnerability can lead to unauthorized access, data breaches, and damage to your application's reputation.
Using older versions of the package that are vulnerable to XSS attacks is not safe and should be avoided. Always update to the latest patched version.
Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the composer.lock file, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/link_field_display_mode_formatter.
