CVE-2025-10926: JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS). This issue affects JSON Field: from 0.0.0 before 1.5.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/json_fieldto a version that resolves this vulnerability.Fixed in 1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10926?
CVE-2025-10926 is classified as a high-severity vulnerability due to its potential for Cross-Site Scripting (XSS) exploitation.
How do I fix CVE-2025-10926?
To fix CVE-2025-10926, upgrade the Drupal JSON Field module to version 1.5 or later.
What products are affected by CVE-2025-10926?
CVE-2025-10926 affects the Drupal JSON Field module versions prior to 1.5.
What kind of attacks are possible with CVE-2025-10926?
CVE-2025-10926 allows attackers to perform Cross-Site Scripting (XSS) attacks, potentially compromising user sessions.
Is CVE-2025-10926 a common vulnerability?
CVE-2025-10926 is specific to the Drupal JSON Field module and may not be widely encountered outside of Drupal environments.