Stored XSS Vulnerability in Drupal Obfuscate Package
Summary
CVE-2025-3130: Drupal Obfuscate Vulnerable to Stored Cross-Site Scripting (XSS). Affects drupal/obfuscate versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal Obfuscate is a package designed to obfuscate JavaScript code in Drupal applications, enhancing security by making it harder for attackers to exploit vulnerabilities. However, it has been found to be vulnerable to a Stored Cross-Site Scripting (XSS) attack, which can compromise the integrity of web applications using this package.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are stored and executed in the context of the user's browser. This can lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The affected versions of the package are from 0.0.0 up to, but not including, 2.0.1.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
composer require drupal/obfuscate:2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the Obfuscate module in your Drupal application until you can apply the patch. This can be done by navigating to the module management page in your Drupal admin interface and unchecking the Obfuscate module.
Conclusion
The Drupal Obfuscate package has a critical vulnerability that allows for Stored XSS attacks. It is crucial for users of this package to update to version 2.0.1 or later to protect their applications from potential exploitation. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/obfuscate →
FAQ
Stored XSS is a type of security vulnerability where an attacker is able to inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected page.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without any signup.
The risks include unauthorized access to user accounts, data theft, and the potential for attackers to perform actions on behalf of users, which can severely compromise the security of the application.
While the best solution is to update to the patched version, you can temporarily disable the Obfuscate module to mitigate the risk until an update can be applied.
After updating the package, thoroughly test your application to ensure that the vulnerability has been resolved and that no new issues have been introduced.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/obfuscate.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
