DRUPAL-CONTRIB-2025-049unknown
DRUPAL-CONTRIB-2025-049
The advisory, in context
The COOKIES module protects users from executing JavaScript code provided by third parties, e.g., to display ads or track user data without consent.
The cookies_asset_injector module (a sub-module of the COOKiES module) also allows inline JavaScript to be included in consent management. However, this does not adequately check whether the provided JavaScript code originates from authorized users.
A potential attacker would at least need permission to create and publish HTML (e.g. content or comments).
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/cookies Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.2.14
Fixed in 1.2.14
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.14"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.2.14"
}
}
],
"versions": []
}