{"id":"DRUPAL-CONTRIB-2025-011","aliases":["CVE-2025-31682","GHSA-36vv-q5jv-94cj"],"title":"DRUPAL-CONTRIB-2025-011","description":"This module enables you to integrate the site with the Google Tag Manager (GTM) application.\n\nThe module doesn't have the \"restrict access\" flag on the \"administer google\\_tag\\_container\" permission. A user with this permission can load a GTM container that completely changes the page or inserts malicious JS, resulting in a cross site scripting vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the aforementioned permission.","severity":"unknown","score":null,"published":"2025-01-29T17:13:29.000Z","modified":"2026-09-10T03:45:54.720Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/google_tag","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.8.0"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<1.8.0"}},{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=2.0.0 <2.0.8"}}],"versions":[],"fixed":["1.8.0","2.0.8"]}],"references":["https://www.drupal.org/sa-contrib-2025-011"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2025-011","modified":"2026-09-10T03:45:54.720349941Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-011"}],"assessments":[]}