CVE-2025-6677
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into web pages generated by Drupal Paragraphs table module, which could execute in users' browsers. It affects Drupal sites using Paragraphs table module versions 2.0.0 through 2.0.4. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- Drupal Paragraphs table module
📦 What is this software?
Paragraphs Table by Paragraphs Table Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full control of the Drupal site, deface content, or install backdoors.
Likely Case
Attackers steal user session cookies, perform unauthorized actions, or redirect users to malicious sites.
If Mitigated
Limited impact with proper input validation and output encoding in place, though vulnerability still exists.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity once the attack vector is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.5
Vendor Advisory: https://www.drupal.org/sa-contrib-2025-084
Restart Required: No
Instructions:
1. Update Paragraphs table module to version 2.0.5 via Drupal's update manager or Composer. 2. Clear Drupal caches. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable Paragraphs table module
allTemporarily disable the vulnerable module until patching is possible
drush pm-disable paragraphs_table
Implement Content Security Policy
allAdd CSP headers to mitigate XSS impact
🧯 If You Can't Patch
- Disable Paragraphs table module entirely
- Implement web application firewall rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check Drupal's Extend page or use 'drush pm-list' to see if paragraphs_table module is installed and check its versionCheck Version:
drush pm-list --fields=name,version | grep paragraphs_tableVerify Fix Applied:
Verify paragraphs_table module version is 2.0.5 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to paragraphs table endpoints
- Suspicious script tags in form submissions
Network Indicators:
- Malicious script payloads in HTTP requests
- Unexpected redirects from the Drupal site
SIEM Query:
source="drupal_access_log" AND (uri="*paragraphs_table*" AND (data="*<script>*" OR data="*javascript:*"))