Executive brief
The Address Suggestion module for Drupal provides address autocomplete functionality to help users enter addresses quickly. The module fails to properly sanitize address data returned by external address provider services, allowing attackers to inject malicious scripts into suggestions. If a user selects a poisoned suggestion, the malicious code executes in their browser, potentially compromising their session or stealing sensitive data.
Technical details
This is a Reflected/Stored Cross-Site Scripting (XSS) vulnerability in the Address Suggestion module's autocomplete functionality. The root cause is insufficient sanitization of address suggestion data returned by configured external address providers (Google Maps, Mapbox, Here Maps, etc.). An attacker must first compromise or intercept responses from a configured provider to inject malicious JavaScript payloads. When a Drupal user performs an address search and the malicious suggestion is displayed and selected, the unsanitized script executes in the user's browser context. The vulnerability is mitigated by the requirement that an attacker control the address provider's data and that a user must interact with the malicious suggestion. The fix is available in version 1.0.25 released 26 August 2026.
Affected products
- Drupal Address Suggestion before 1.0.25
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Version 1.0.25 released