CVE-2025-31687: Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability

April 1, 2025 (updated April 29, 2025)

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS). This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.

References

git.drupalcode.org/project/spamspan
git.drupalcode.org/project/spamspan/-/commit/90d622211c8bb316080a3af1dcf253b0d7e90791
github.com/advisories/GHSA-8r2q-865v-wm8j
nvd.nist.gov/vuln/detail/CVE-2025-31687
www.drupal.org/sa-contrib-2025-016

Code Behaviors & Features

Detect and mitigate CVE-2025-31687 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →