Drupal JSON Field
CVE-2025-10926
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Drupal page/form using JSON Field
-
DeliverySubmit crafted JSON payload with script
-
ExploitPayload stored/reflected unsanitized
-
ExecutionVictim loads affected page (UI:R)
-
PersistScript executes in victim browser
-
ImpactSession/credential theft or UI manipulation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target Drupal site to have the 'JSON Field' contributed module installed at a version below 1.5, and a page or form that accepts and later renders JSON Field input without sanitization. Per the CVSS vector, successful exploitation requires victim user interaction (UI:R) - a user must view or interact with the page carrying the injected payload - which limits automated or drive-by exploitation. The published vector asserts no privileges (PR:N), but if payload submission actually requires a content-authoring role, the realistic prerequisite is an authenticated editor account; this should be confirmed against SA-contrib-2025-106. Impact is confined to the browser/session context (confidentiality and integrity Low, no availability impact). |
| Impact | This is a moderate-severity reflected/DOM-relevant Cross-Site Scripting flaw (CWE-79) in the Drupal 'JSON Field' contributed module, versions from 0.0.0 before 1.5. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) indicates network-reachable, low-complexity exploitation with no privileges but requiring user interaction, and a scope change reflecting impact on the victim's browser context rather than the server. Exploitation signals are weak-to-absent: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis - so this is best characterized as a real-but-low-urgency issue rather than an active threat. The signals are internally consistent (no conflict between a low EPSS and the absence of KEV/POC). The main residual uncertainty is the privilege requirement: many Drupal field XSS issues in practice require a user with content-creation/editing permission to inject the payload, yet the published vector asserts PR:N - this PR:N/UI:R combination should be verified against the Drupal security advisory (SA-contrib-2025-106) before concluding the injection vector is truly unauthenticated. |
| Exploit ScenarioDerived | An attacker supplies a crafted value to a JSON Field that is stored and later rendered without proper output neutralization; when a victim views the affected page, the injected script executes in their browser session. Because the CVSS vector specifies UI:R, the attack succeeds only when a user loads or interacts with the page containing the malicious field content. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cross-site scripting in the Drupal contributed module JSON Field (versions from 0.0.0 before 1.5) allows injected script to execute in the browser of a user who views a page rendering unsanitized JSON Field output. Per the CVSS vector AV:N/AC:L/PR:N/UI:R, exploitation is remote but requires victim user interaction, and per the independent assessment the realistic prerequisite is that the target site has the module installed below 1.5 and exposes a page or form that accepts and later renders JSON Field input without sanitization; impact is confined to the browser/session context with Low confidentiality and integrity impact and no availability impact. Exploitation status: no public exploit identified at time of analysis, and the EPSS score is low at 0.20% (9th percentile), so mass scanning and opportunistic exploitation are unlikely. No CISA KEV entry is present for this CVE.
RemediationAI
Vendor-released patch: upgrade the Drupal JSON Field contributed module to version 1.5 or later, which is the fixed release referenced from the Drupal security advisory https://www.drupal.org/sa-contrib-2025-106. Apply the update through Composer (for example, composer update drupal/json_field) and then run the Drupal database update routine, verifying afterwards with composer show drupal/json_field that the installed version is 1.5 or higher; note that contributed-module updates may require clearing caches or re-exporting configuration, so test on a staging copy first. If an immediate upgrade is not possible, compensating controls include: restricting content-authoring and JSON Field editing permissions to a minimal, trusted set of roles (this reduces the PR:L/PR:H attacker population but does not eliminate the UI:R delivery path); turning off or removing any JSON Field display formatter that outputs raw or unescaped values until the module is patched (side effect: JSON content may no longer render as intended); and mitigating at the edge by enforcing a strict Content-Security-Policy that disallows inline script execution, which blocks most payload execution but can break themes and third-party front-end scripts and must be rolled out in report-only mode first. Keeping Drupal access behind authentication, applying standard XSS output-escaping reviews for any custom templates that print JSON Field values, and monitoring security advisories for follow-up SA-contrib-2025-106 clarifications round out the mitigation set. Per the available data there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, so patch-on-next-maintenance-window is a defensible cadence for non-Internet-exposed sites.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the JSON Field contributed module for Drupal (CPE cpe:2.3:a:json_field_project:json_field:*:*:*:*:*:drupal:*:*), which provides a field type for storing and rendering JSON data on Drupal entities. The flaw is CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), meaning user-controllable JSON Field content is emitted into generated HTML without adequate escaping or contextual encoding, so markup such as script tags or event-handler attributes survives into the page and executes in the victim's browser. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity attack whose scope changes (S:C) because the payload moves from the vulnerable Drupal component into the victim's browser security context; confidentiality and integrity impacts are both Low, and availability is unaffected. The vector asserts no privileges (PR:N), but because JSON Field content is normally authored through the site's content-editing interfaces, the independent assessment notes that in practice submission may require a content-authoring role, in which case the realistic adversary is an authenticated editor; this nuance should be confirmed against the vendor advisory SA-contrib-2025-106. No authentication bypass, memory-corruption, or server-side code execution primitive is present in the technical data - this is purely a client-side script-injection defect.
Know when Json Field gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable XSS executing in the victim's browser requires user interaction (UI:R) and crosses a trust boundary (S:C) with limited confidentiality/integrity impact; PR:N retained per vendor vector though authoring access may be needed.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC
Exploit-DB