This vulnerability (CVE-2025-31675) in Drupal core is a Cross-Site Scripting (XSS) issue caused by improper neutralization of input during web page generation. It affects Drupal core versions from 8.0.0 up to but not including 10.3.14, 10.4.0 up to but not including 10.4.5, 11.0.0 up to but not including 11.0.13, and 11.1.0 up to but not including 11.1.5, as well as Drupal 7 module versions 7.x-1.0 through 7.x-1.12. The vulnerability allows an attacker with low privileges and requiring user interaction to inject malicious scripts, potentially impacting confidentiality and integrity but not availability. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. No vendor advisory or patch information is provided in the input.

An attacker with low privileges and requiring user interaction could exploit this vulnerability to execute arbitrary scripts in the context of another user, potentially leading to partial confidentiality and integrity compromise. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the official Drupal vendor advisory for current remediation guidance. Since no patch links or vendor advisory content are provided, users should monitor Drupal's official security announcements and apply updates to versions 10.3.14, 10.4.5, 11.0.13, or 11.1.5 or later once available. Until patched, limit exposure by restricting user privileges and exercising caution with user-generated content requiring interaction.