Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-02T13:18:12.467Z",
  "pubdate": "2026-09-02T13:18:12.467Z",
  "executiveSummary": "The Address Suggestion module for Drupal is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw originates from improper neutralization of user-supplied input during the web page generation process.\nThe vulnerability allows an unauthenticated or authenticated attacker to inject arbitrary client-side scripts into the victim's browser session. By successfully executing malicious JavaScript, an attacker can compromise user sessions, perform actions on behalf of the user, exfiltrate sensitive data, or redirect users to malicious domains.\nThis issue impacts all versions of the Address Suggestion module ranging from 0.0.0 to 1.0.25. The risk is considered significant as it facilitates unauthorized client-side execution within the context of the Drupal application's security domain. Exploitation typically requires the victim to interact with a specifically crafted malicious link or resource, relying on the application's failure to adequately sanitize or encode input before rendering it in the Document Object Model (DOM).",
  "technicalDetails": "The vulnerability is identified as a failure to implement appropriate output encoding or input sanitization mechanisms within the Address Suggestion module's rendering logic. Specifically, the module fails to neutralize user-controlled input before reflecting it back to the end-user's browser, satisfying the definition of CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').\nIn the context of the Address Suggestion module, the attack vector involves the manipulation of input parameters that are subsequently processed by the module and included in the HTTP response. Because the module does not properly sanitize these inputs or contextually encode the output, a browser interprets the injected payloads as legitimate script elements rather than plain text data.\nThe exploitation flow typically follows these steps: First, the attacker identifies a parameter within the Address Suggestion functionality that is reflected in the application's output. Second, the attacker crafts a malicious payload containing JavaScript, such as '<script>alert(document.cookie)</script>' or more sophisticated obfuscated scripts designed to steal session tokens or perform background XHR/Fetch requests. Third, the attacker tricks a legitimate user into navigating to the crafted URL containing this payload. Upon the victim's browser rendering the page, the application serves the malicious script within the HTML response. Finally, the browser executes the injected code within the origin of the Drupal site, granting the attacker access to the document, cookies, local storage, and the ability to modify the DOM structure of the page.\nSince this is a reflected XSS vulnerability, the impact is confined to the specific users who trigger the malicious request. However, if the XSS occurs on a page with administrative access, the potential for privilege escalation or full site takeover exists if the attacker manages to compromise an administrative session. The affected versions (0.0.0 through 1.0.25) lack the necessary security headers or output filtering routines to prevent this interaction. The attack does not necessarily require the attacker to have administrative privileges on the target system, making it an effective vector for external threats targeting the site's user base."
}