[Security-news] JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-106

Project: JSON Field [1]
Date: 2025-September-24
Security risk: *Critical* 15 ∕ 25
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross Site Scripting

Affected versions: <1.5
CVE IDs: CVE-2025-10926
Description: 
This module enables you to store and display JSON data using optional 3rd
party libraries.

The module doesn't sufficiently filter data using some of the included field
formatters leading to a Cross-site Scripting (XSS) vulnerability.

Solution: 
Install the latest version:

  * If you use the JSON Field module for Drupal 8.x, upgrade to JSON Field
    8.x-1.5 [3].

Reported By: 
  * Ivan  (chi) [4]

Fixed By: 
  * Ivan  (chi) [5]
  * Damien McKenna (damienmckenna) [6] of the Drupal Security Team

Coordinated By: 
  * Damien McKenna (damienmckenna) [7] of the Drupal Security Team
  * Greg Knaddison (greggles) [8] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [9]

[1] https://www.drupal.org/project/json_field
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/json_field/releases/8.x-1.5
[4] https://www.drupal.org/u/chi
[5] https://www.drupal.org/u/chi
[6] https://www.drupal.org/u/damienmckenna
[7] https://www.drupal.org/u/damienmckenna
[8] https://www.drupal.org/u/greggles
[9]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3548415