DRUPAL-CORE-2025-001 in drupal/core
Published 19 Feb 2025 · Updated 19 Sept 2026
Affected package
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
composer require drupal/core:^11.1.3Details
Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS).
Sites are encouraged to update. There are not yet public documented steps to exploit this, but there may be soon given the nature of this issue.
This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected, but are still encouraged to upgrade in the near future.
Is DRUPAL-CORE-2025-001 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.