CVE-2025-12083: CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS). This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/civicthemeto a version that resolves this vulnerability.Fixed in 1.12.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12083?
CVE-2025-12083 has a medium severity level due to its potential for XSS attacks.
How do I fix CVE-2025-12083?
To fix CVE-2025-12083, upgrade the CivicTheme Design System to version 1.12.0 or later.
What type of vulnerability is CVE-2025-12083?
CVE-2025-12083 is a Cross-Site Scripting (XSS) vulnerability.
Which versions of CivicTheme Design System are affected by CVE-2025-12083?
CVE-2025-12083 affects all versions of CivicTheme Design System before 1.12.0.
What are the potential impacts of CVE-2025-12083?
The potential impacts of CVE-2025-12083 include session hijacking and unauthorized actions via XSS attacks.