CVE-2025-31697: Drupal Formatter Suite Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2025-31697: Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes. Affects drupal/formatter_suite versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Formatter Suite is a widely used package in the Drupal ecosystem that provides various formatting options for content. It allows developers to customize how content is displayed on their websites. However, the package has a vulnerability that can lead to Cross-Site Scripting (XSS) attacks, which can compromise the security of web applications using this package.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, specifically through link element attributes. This flaw allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized actions, data theft, or session hijacking. The affected versions are from 0.0.0 up to, but not including, 2.1.0.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
composer require drupal/formatter_suite:2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider sanitizing user inputs and escaping outputs in your application to mitigate the risk of XSS attacks. This can be done using Drupal's built-in functions for handling user input safely.
Conclusion
The Drupal Formatter Suite has a critical vulnerability that allows for Cross-Site Scripting attacks. It is essential to update to version 2.1.0 or later to protect your application from potential threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for drupal/formatter_suite →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and application security.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failing to address this vulnerability can lead to data breaches, unauthorized access to user accounts, and damage to your application's reputation.
Using older versions that are vulnerable to XSS attacks poses significant security risks. It is highly recommended to update to the latest patched version.
If you suspect a compromise, immediately update the affected package, review your logs for suspicious activity, and consider conducting a security audit of your application.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/formatter_suite.
