BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-02-06

Assigner: Drupal.org

Description

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-02-06

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13984

EUVD

EUVD-2025-206437

Affected Vendors & Products

Vendor	Product	Version / Range
kanopi	next.js	to 1.6.4 (exc)
kanopi	next.js	From 2.0.0 (inc) to 2.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

This vulnerability is a Permissive Cross-domain Security Policy with Untrusted Domains in Drupal Next.Js that allows Cross-Site Scripting (XSS). It affects versions of Next.Js from 0.0.0 before 1.6.4, and from 2.0.0 before 2.0.1.

Impact Analysis

The vulnerability can allow attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to unauthorized actions, data theft, or session hijacking when interacting with affected Drupal Next.Js applications.

Hi! I’m here to help you understand CVE-2025-13984. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70