Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Published: 2025-10-29
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-h72q-cq3w-h3wc Drupal CivicTheme Design System allows Cross-Site Scripting (XSS)
References
Link Providers
https://www.drupal.org/sa-contrib-2025-113 cve-icon cve-icon
History

Wed, 03 Dec 2025 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Salsa.digital
Salsa.digital civictheme Design System
CPEs cpe:2.3:a:salsa.digital:civictheme_design_system:*:*:*:*:*:drupal:*:*
Vendors & Products Salsa.digital
Salsa.digital civictheme Design System

Thu, 30 Oct 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Drupal
Drupal civictheme Design System
Drupal drupal
Vendors & Products Drupal
Drupal civictheme Design System
Drupal drupal

Wed, 29 Oct 2025 23:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Title CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113
Weaknesses CWE-79
References

Subscriptions

Drupal Civictheme Design System Drupal
Salsa.digital Civictheme Design System
cve-icon MITRE

Status: PUBLISHED

Assigner: drupal

Published:

Updated: 2025-10-30T14:40:11.746Z

Reserved: 2025-10-22T16:06:23.591Z

Link: CVE-2025-12083

cve-icon Vulnrichment

Updated: 2025-10-30T14:40:02.920Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-30T00:15:34.660

Modified: 2025-12-03T20:08:49.093

Link: CVE-2025-12083

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-10-30T14:37:41Z

Weaknesses