Drupal Facets CVE-2025-9550

Exploitation requires the Drupal Facets (faceted search) module to be installed and active on versions before 2.0.10 (0.x/2.x branch) or before 3.0.1 (3.x branch), and requires a victim to interact with attacker-supplied content (UI:R) - for example clicking a crafted link or viewing a page containing injected facet markup. The limiting factors are the mandatory user interaction and the requirement that the site run the vulnerable Facets module version; impact is constrained to limited confidentiality and integrity (C:L/I:L) within the browser context, with no availability impact. No elevated privileges are needed by the attacker (PR:N), but delivery depends on luring a user to the malicious content.

This is a moderate-severity (CVSS 6.1) cross-site scripting flaw whose signals point to a low-urgency, non-emergency priority. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows network reachability with no privileges required but mandatory user interaction (UI:R) and only limited confidentiality/integrity impact - characteristic of XSS where a victim must load attacker-influenced content. The scope change (S:C) reflects script executing in the browser security context, typical for XSS. Exploitation signals are reassuring: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so there is no evidence of active exploitation. These signals are internally consistent - a genuine but low-probability-of-exploitation issue. No SSVC decision data was provided. Overall this is a 'patch in normal cycle' item rather than a drop-everything priority, though XSS in a search/faceting component can be leveraged for session theft or admin-targeted phishing if left unpatched.

An attacker crafts a URL or input containing malicious script that is reflected or stored through the Drupal Facets faceted-search interface. When a victim (potentially an authenticated site administrator or editor) views the page, the script executes in their browser session, enabling cookie/session theft or actions in the site's context. No public proof-of-concept was identified, and the attack requires the victim to interact with the malicious content (UI:R).