Overview
A new security concern has emerged for users of the Facets module in Drupal. This vulnerability, identified as CVE-2025-9550, is a type of Cross-Site Scripting (XSS) flaw that has been rated as a medium-severity issue. An XSS vulnerability allows malicious scripts to be injected into trusted websites. When other users visit the affected pages, these scripts can execute in their browsers. This could lead to various problems, such as stealing user information or taking control of their accounts.
CVE Details
- Product: Drupal Facets module
- Published: October 10, 2025
- Severity: Medium (CVSS Score 6.1)
- Status: Analyzed
Affected Products
The Cross-Site Scripting vulnerability impacts specific versions of the Facets module for Drupal. The affected versions are:
- Facets module versions from 0.0.0 up to, but not including, 2.0.10.
- Facets module versions from 3.0.0 up to, but not including, 3.0.1.
If your Drupal website uses the Facets module within these version ranges, it is vulnerable to this issue.
Current Status
The vulnerability has been officially analyzed. This means that its details have been confirmed and are publicly known.
Severity Level
This Cross-Site Scripting vulnerability in Drupal Facets is classified as "Medium" severity, with a CVSS score of 6.1. While not critical, a medium-severity issue still poses a significant risk. Attackers could exploit this flaw to inject malicious code, potentially compromising user sessions or defacing parts of the website. It’s crucial for administrators to address this vulnerability promptly to prevent potential harm.
Possible Solutions
To secure your Drupal website against the CVE-2025-9550 vulnerability, it is essential to update your Facets module. Based on the provided vulnerability description, the fix involves upgrading to a patched version.
- Users running Facets 2.x should update to version 2.0.10 or later.
- Users running Facets 3.x should update to version 3.0.1 or later.
Always ensure you back up your website before performing any updates. Regularly updating all modules, themes, and the Drupal core is a critical practice for maintaining a secure website. Consider reviewing resources on Understanding Cross-Site Scripting (XSS) Attacks and Best Practices for Securing Your Drupal Website for broader security insights.
References
https://www.drupal.org/sa-contrib-2025-100
