Cross-Site Scripting Vulnerability in Drupal CivicTheme Design System
CVE-2025-12083

6.1MEDIUM

Key Information:

Vendor

Drupal
Status
Civictheme Design System
Vendor
CVE Published:
29 October 2025

What is CVE-2025-12083?

A Cross-Site Scripting (XSS) vulnerability exists in the CivicTheme Design System used by Drupal, allowing attackers to inject malicious scripts into web pages. This can lead to various security issues, including data theft and unauthorized actions on behalf of users. The vulnerability affects versions of CivicTheme Design System from 0.0.0 prior to the 1.12.0 release, necessitating prompt upgrades for all users to enhance their security posture.

Affected Version(s)

CivicTheme Design System 0.0.0 < 1.12.0

References

https://www.drupal.org/sa-contrib-2025-113

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Bramley (acbramley)
Lee Rowlands (larowlan)
Alan Cole (alan.cole)
Daniel (danielgry)
Fiona Morrison (fionamorrison23)
Suchi Garg (gargsuchi)
Lee Rowlands (larowlan)
Richard Gaunt (richardgaunt)
Greg Knaddison (greggles)
Lee Rowlands (larowlan)
Drew Webber (mcdruid)
JSON
.
CVE-2025-12083 : Cross-Site Scripting Vulnerability in Drupal CivicTheme Design System