CVE-2025-11570: drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS
drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS
Other sources
Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data.
Note: This is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Pattern Lab.
The package drupal-pattern-lab/unified-twig-extensions is unmaintained, the fix for this issue exists in version 1.1.1 of drupal/unifiedtwigext, but is not published to the Composer PHP registry.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/unified_twig_extto a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11570?
CVE-2025-11570 has a moderate severity due to its potential to allow Cross-site Scripting (XSS) attacks.
How do I fix CVE-2025-11570?
To fix CVE-2025-11570, update the drupal-pattern-lab/unified-twig-extensions package to a version that is not vulnerable.
Which versions are affected by CVE-2025-11570?
CVE-2025-11570 affects versions of drupal-pattern-lab/unified-twig-extensions from 0.0.0.
Is the CVE-2025-11570 vulnerability exploitable in Drupal?
CVE-2025-11570 is exploitable only if the code is executed outside of Drupal.
What kind of vulnerability is CVE-2025-11570?
CVE-2025-11570 is a Cross-site Scripting (XSS) vulnerability due to insufficient data filtering.