CVE-2025-48923
BaseFortify
Publication date: 2025-06-26
Last updated on: 2025-07-09
Assigner: Drupal.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| toc.js_project | toc.js | to 3.2.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-48923 is a Cross-Site Scripting (XSS) vulnerability in the Toc.js module for Drupal, which generates tables of content on pages. The issue arises from insufficient sanitization of data attributes, allowing attackers with certain user permissions to inject malicious scripts. Exploitation requires the attacker to have a user role that permits inputting HTML tags with specific data attributes, making it moderately critical but uncommon. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in the context of your website, potentially compromising confidentiality and integrity of data. However, exploitation requires specific user permissions and user interaction, so the risk is moderate and the occurrence is uncommon. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking the version of the Toc.js module installed in your Drupal environment to see if it is prior to 3.2.1. Additionally, monitoring for unusual user input containing HTML tags with specific data attributes that could be used for XSS attacks may help. There are no specific commands provided in the resources for detection. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the Toc.js module to version 3.2.1, which contains the fix for the Cross-site Scripting vulnerability. Also, review user roles and permissions to limit the ability to input HTML tags with data attributes that could be exploited. [1]