PT-2025-41502 · Unknown · Drupal-Pattern-Lab/Unified-Twig-Extensions+2

Pierre Rudloff · CVE-2025-11570 · Published 2025-10-10 · Updated 2026-05-22

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions drupal-pattern-lab/unified-twig-extensions versions 0.0.0 through 1.1.0

Description The package contains a Cross-site Scripting (XSS) issue because of inadequate data filtering. This is only exploitable when the code runs outside of Drupal, as the function is designed for use in both Drupal and Pattern Lab.

Recommendations Update to version 1.1.1 or later of drupal/unified twig ext.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11570

GHSA-64MV-9655-37HX

Affected Products

Pattern Lab

Drupal-Pattern-Lab/Unified-Twig-Extensions

Drupal/Unified Twig Ext

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-11570 · Security Note
• https://osv.dev/vulnerability/GHSA-64mv-9655-37hx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11570 · Vendor Advisory
• https://github.com/drupal-pattern-lab/unified-twig-extensions · Note
• https://github.com/drupal-pattern-lab/unified-twig-extensions/blob/862b9deccab544ca68e3aaaccc257d14acc9b1f6/example/_twig-components/functions/link.function.php%23L9 · Note
• https://security.snyk.io/vuln/SNYK-PHP-DRUPALPATTERNLABUNIFIEDTWIGEXTENSIONS-8400877 · Note
• https://twitter.com/VulmonFeeds/status/1976661008769831069 · Twitter Post
• https://twitter.com/CVEnew/status/1976517011942343128 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o425y4/resumen_diario_de_vulnerabilidades_11102025 · Reddit Post
• https://drupal.org/sa-contrib-2023-041 · Note
• https://t.me/cveNotify/138092 · Telegram Post
• https://drupal.org/project/unified_twig_ext · Note
• https://t.me/cveNotify/164633 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o42xq1/resumen_diario_de_vulnerabilidades_11102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o5knot/resumen_diario_de_vulnerabilidades_13102025 · Reddit Post