DRUPAL-CONTRIB-2025-121
NoneCVSS
—
EPSS
—
Published
Dec 3, 2025
CISA due date
—
The record
This module enables you to use the Tagify library to enhance text input fields with tag-style UI elements. The module does not sufficiently sanitize the `infoLabel` value under certain configurations, which can result in a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that only uncommon module configurations expose the affected `infoLabel` output, and an attacker must have user-level access to supply or manipulate this value.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal/tagify | 0 | 1.2.44 |
Related vulnerabilities
- CVE-2025-13983 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… Same vulnerability
- CVE-2026-3212 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… Also affects drupal/tagify
- DRUPAL-CONTRIB-2026-013 This module integrates the Tagify JavaScript library to enhance taxonomy entity reference… Also affects drupal/tagify