DRUPAL-CONTRIB-2025-007

The advisory, in context

This module enables you to render error pages using the Ignition package.

The module disables certain Drupal core code and does not perform sufficient filtering, allowing HTML to be injected in certain situations leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that this module is for development purposes and is not intended to be installed on production environments.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

drupal/ignition Packagist:https://packages.drupal.org/8

Ecosystem versions

Earlier releases before 1.0.4

Fixed in 1.0.4

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.4"
        }
      ],
      "type": "ECOSYSTEM",
      "database_specific": {
        "constraint": "<1.0.4"
      }
    }
  ],
  "versions": []
}

drupal/ignition Packagist