CVE-2025-31696: Drupal RapiDoc OAS Field Formatter Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2025-31696: Drupal RapiDoc OAS Field Formatter Cross-Site Scripting (XSS) vulnerability. Affects drupal/rapidoc_elements_field_formatter versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal RapiDoc OAS Field Formatter is a package designed to enhance the presentation of OpenAPI specifications within Drupal applications. It allows developers to format and display API documentation in a user-friendly manner. However, this package has been found to be vulnerable to a Cross-Site Scripting (XSS) attack, which can compromise the security of applications using it.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by users. This can lead to unauthorized actions being performed on behalf of users, data theft, or session hijacking. The vulnerability affects versions of the RapiDoc OAS Field Formatter prior to 1.0.1, making it crucial for users to update to the latest version to mitigate risks.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
composer require drupal/rapidoc_elements_field_formatter:1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider sanitizing user inputs and outputs to prevent XSS attacks. Implementing Content Security Policy (CSP) headers can also help mitigate the risk by restricting the sources from which scripts can be executed.
Conclusion
The Drupal RapiDoc OAS Field Formatter has a critical XSS vulnerability that can expose applications to significant security risks. It is essential to update to version 1.0.1 or later to protect against potential attacks. Additionally, implementing best practices for input sanitization and security policies can further enhance your application's security.
See every vulnerability recorded for drupal/rapidoc_elements_field_formatter →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and session integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences can include unauthorized access to user accounts, data theft, and the ability for attackers to perform actions on behalf of users.
Yes, you can implement input sanitization and use Content Security Policy (CSP) headers to help mitigate the risk of XSS attacks.
If you encounter issues after updating, check the package documentation for any breaking changes and ensure that your application is compatible with the new version.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/rapidoc_elements_field_formatter.
