{"id":"GHSA-64mv-9655-37hx","aliases":["CVE-2025-11570"],"title":"drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"LOW","description":"Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data.\n\n**Note:**\nThis is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Pattern Lab.\n\nThe package drupal-pattern-lab/unified-twig-extensions is unmaintained, the fix for this issue exists in version 1.1.1 of [drupal/unified_twig_ext](https://www.drupal.org/project/unified_twig_ext), but is not published to the Composer PHP registry.","severity":"low","score":1.9,"published":"2025-10-10T06:30:55.000Z","modified":"2025-10-11T00:12:31.431Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"drupal-pattern-lab/unified-twig-extensions","sources":[{"name":"OSV · GHSA-64mv-9655-37hx","url":"https://osv.dev/vulnerability/GHSA-64mv-9655-37hx"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"0.1.0"}],"type":"ECOSYSTEM"}],"versions":["v0.1.0"],"fixed":[]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-11570","https://github.com/drupal-pattern-lab/unified-twig-extensions","https://github.com/drupal-pattern-lab/unified-twig-extensions/blob/862b9deccab544ca68e3aaaccc257d14acc9b1f6/example/_twig-components/functions/link.function.php%23L9","https://security.snyk.io/vuln/SNYK-PHP-DRUPALPATTERNLABUNIFIEDTWIGEXTENSIONS-8400877","https://www.drupal.org/project/unified_twig_ext","https://www.drupal.org/sa-contrib-2023-041"],"sources":[{"name":"OSV","id":"GHSA-64mv-9655-37hx","modified":"2025-10-11T00:12:31.431371Z","url":"https://osv.dev/vulnerability/GHSA-64mv-9655-37hx"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","score":1.9}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:20:32.181Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}