GHSA-8r2q-865v-wm8j

Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2025-31687

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	drupal/spamspan	< 3.2.1	3.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS). This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-31687 advisory
https://git.drupalcode.org/project/spamspan package
https://git.drupalcode.org/project/spamspan/-/commit/90d622211c8bb316080a3af1dcf253b0d7e90791 web
https://www.drupal.org/sa-contrib-2025-016 web