CVE-2025-3902
Block Class enables you to add custom attributes to blocks. The module did not sufficiently sanitize custom attribute input, allowing for potential X...
Original description
The description as published by the source.
Block Class enables you to add custom attributes to blocks.
The module did not sufficiently sanitize custom attribute input, allowing for potential XSS attacks when malicious JavaScript was injected as a custom attribute.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer block classes".
Affected packages
Packagist:https://packages.drupal.org/8
drupal/block_class
[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}],"database_specific":{"constraint":">=4.0.0 <4.0.1"}}]
References
- web drupal.org