DRUPAL-CONTRIB-2025-043

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/block_class/DRUPAL-CONTRIB-2025-043.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2025-043
Aliases
  • CVE-2025-3902
Published
2025-04-23T16:59:01Z
Modified
2025-12-10T23:41:29.742564Z
Summary
[none]
Details

Block Class enables you to add custom attributes to blocks.

The module did not sufficiently sanitize custom attribute input, allowing for potential XSS attacks when malicious JavaScript was injected as a custom attribute.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer block classes".

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/block_class

Package

Name
drupal/block_class
Purl
pkg:composer/drupal/block_class

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.0.1
Database specific 
{
    "constraint": ">=4.0.0 <4.0.1"
}

Database specific

source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/block_class/DRUPAL-CONTRIB-2025-043.json"
affected_versions 
">=4.0.0 <4.0.1"