CVE-2025-31675

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications. The Link module in Drupal core provides secure link construction to the system.

The exploit was also found in versions of the Link module used by Drupal 7.

The fix provided by HeroDevs introduces the AttributeXss class, which parses attribute strings into arrays while skipping prohibited attributes and selectively stripping dangerous protocols from URI-like values unless the attribute is safe (e.g., title, class, or data-*). The sanitizeAttributes() method processes attribute arrays by reconstructing and filtering each key-value pair, ensuring only safe ones are retained before rendering, thus preventing malicious attributes from reaching the output.

A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:

• Session hijacking
• Data theft
• Malware distribution
• Defacement or phishing, and
• Privilege escalation.

This issue affects all versions of Drupal 7 Link below 7.1.13 and is patched in Link NES version 7.1.14.

‍

Details

Module Info

• Product: Drupal
• Affected code: Link module
• Affected versions: <7.1.13
• Project page: https://www.drupal.org/project/drupal
• Fixed in:  Link NES 7.1.14

‍

Vulnerability Info

This medium-severity vulnerability is found in all versions of the Link module lower than 7.13.

The exploit first described in Drupal 10 core (CVE-2025-31675) is a stored cross-site scripting (XSS) vulnerability affecting the Link field. Insufficient sanitization allows attackers with edit permissions—typically via web services, REST APIs, or custom/contrib modules—to inject malicious attributes into link render arrays. For instance, an attacker could add attributes like onmouseover="alert('XSS')" or style="javascript:alert('XSS')", which would be rendered in the HTML output. When a victim views or interacts with the link (e.g., hovering over it), the injected JavaScript executes in their browser context, potentially leading to session hijacking, data theft, or further attacks. This is mitigated if no link fields are used or if the Link module is disabled, and it requires attacker access to modify link attributes, making it moderately critical.

‍

Addressing the Issue

Users of the affected component(s) should address this exploit in one of the following ways:

• Ensure only trusted users have access to APIs or the database through which a malicious link can be added.
• Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.

‍

Credits

• Samuel Mortenson (samuel.mortenson)

‍

Additional Resources

• This exploit was first found in later versions of Drupal:
  Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
  https://www.drupal.org/SA-CORE-2025-004
• NIST CVE
  https://nvd.nist.gov/vuln/detail/CVE-2025-31675

‍