Dave Long

Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module fails to sufficiently validate icon settings provided by users before they are rendered.

An issue exists where the module does not sufficiently sanitize certain attributes, leading to cross-site scripting (XSS), a flaw that allows attackers to inject malicious scripts into web pages. Approximately 15,300 instances have been identified globally. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

An Unsafe Reflection issue exists where externally-controlled input can be used to select classes or code, leading to Reflection Injection. This flaw allows for remote code execution. While the issue is not directly exploitable using the module in isolation, multiple serious exploit paths exist when combined with other contributed modules, including at least one path that does not require authentication. Custom code may also expose this functionality.

An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

A remote code execution issue exists within the Field UI module (`field ui`) in Drupal core. While the issue is not directly exploitable using core functionality alone, multiple serious exploit paths are available through the use of contributed modules or custom code. At least one known exploit path allows for unauthenticated remote code execution. Approximately 151,000 sites are potentially affected due to the use of outdated CMS branches. This flaw can be used to achieve lateral movement from compromised web servers into internal infrastructure.

Improper neutralization of special elements used in a template engine allows for code injection. The module fails to sufficiently mitigate Twig template injections in certain rules, enabling the use of Twig functions to extract confidential system data. Twig is a template engine for PHP that allows developers to generate HTML by combining static templates with dynamic data.

A security issue exists in the Disable Login Page project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue.

Drupal core contains a cross-site scripting (XSS) issue due to improper neutralization of input during web page generation. The XSS filter does not sufficiently sanitize certain attributes from the integrated HTMX JavaScript library, allowing an attacker to execute malicious scripts if they can insert HTML with specific attributes.

Stored Cross-site Scripting (XSS) occurs because the Layout Builder module does not sufficiently sanitize block labels in certain scenarios. This allows an attacker to inject malicious scripts that are stored and later executed in the browser of another user. Exploitation requires both the attacker and the targeted user to be using the Layout Builder editing interface.

Improperly controlled modification of dynamically-determined object attributes allows Object Injection. Additionally, the Render submodule fails to sufficiently sanitize template code when rendering inline Twig templates as part of no-code models, which can lead to information disclosure. This issue is mitigated if the site is not running an ECA model that utilizes the "Render: Twig" action on a data flow.

An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting (XSS). Cross-site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Exploitation requires the attacker to have permissions to create or update content rendered by UI Patterns.

A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently re-evaluate human-in-the-loop approval gates during workflow iterations that occur more than once. This can lead to the execution of workflows not intended by the user. Exploitation requires the attacker to possess the "Administer FlowDrop workflows" role or equivalent permissions such as "Create FlowDrop workflows" or "Edit FlowDrop workflows".

A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently enforce permissions on certain endpoints. This may allow attackers to trigger workflow execution, resulting in LLM (Large Language Model) costs and tool side effects, or enable them to send messages into sessions belonging to other users. This issue is mitigated if the attacker does not possess the "View any session" permission, which is not granted to anonymous or authenticated users by default.

Drupal core contains a gadget chain, which is a sequence of existing code fragments that can be leveraged during the deserialization of untrusted data. While this issue is not directly exploitable, it can serve as a vector to achieve remote code execution or SQL injection if a separate vulnerability allows an attacker to pass unsafe input to the `unserialize()` function.

The JSON:API and REST modules allow image file uploads to image fields. The validation rules verify the file extension but fail to check the file MIME type (Multipurpose Internet Mail Extensions), which is a standard used to identify the nature and format of a document. This flaw allows a malicious user to upload non-image files. Depending on the web-server configuration, these files may be served using their actual MIME type, potentially leading to cross-site scripting (XSS), where malicious scripts are injected into trusted websites, or other unexpected behavior.

The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location.

The `rebuild.php` front controller, used to clear caches and rebuild the container when a site is in an unexpected condition, fails to correctly validate the Host header against trusted host patterns. This flaw can lead to cache poisoning, where a cache is filled with a malicious response, or an open redirect, which sends users to an attacker-controlled domain.

An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default.

Stored Cross-site Scripting (XSS) occurs because the module fails to properly sanitize the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This allows an attacker with permissions to create or edit taxonomy terms in a vocabulary to execute arbitrary JavaScript within the context of a user session.