Executive brief
The drupal-pattern-lab/unified-twig-extensions library, which allows Drupal and Pattern Lab to share design components, contains a security flaw that could allow attackers to execute malicious scripts in a user's browser. This occurs when the library is used outside of the standard Drupal environment without proper data filtering. An exploit could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A Cross-site Scripting (XSS) vulnerability exists in the drupal-pattern-lab/unified-twig-extensions package (and the corresponding drupal/unified_twig_ext module) due to insufficient input sanitization in Twig functions, specifically within example implementations like the link function. The vulnerability is root-caused by a failure to filter data before it is rendered in a web page. This is primarily exploitable when the code is executed outside of the Drupal core environment (e.g., in Pattern Lab) where Drupal's built-in XSS protections may not be active. An attacker with low-level privileges can provide malicious input that, when viewed by another user, executes arbitrary JavaScript. The original package is unmaintained; users should migrate to the patched version of the Drupal module.
Affected products
- drupal-pattern-lab unified-twig-extensions >=0.0.0
- drupal unified_twig_ext <1.1.1
Timeline
- 2023-08-30: advisory: Drupal security advisory SA-CONTRIB-2023-041 released
- 2024-11-04: disclosed: Vulnerability disclosed to Snyk
- 2024-12-09: other: Snyk advisory published
- 2025-10-10: disclosed: CVE-2025-11570 published