PT-2025-41502 · Unknown · Pattern Lab+2

Pierre Rudloff · Published 2025-10-10 · Updated 2025-10-13 · CVE-2025-11570

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions drupal-pattern-lab/unified-twig-extensions versions 0.0.0 through 1.1.0

Description The package contains a Cross-site Scripting (XSS) issue because of inadequate data filtering. This is only exploitable when the code runs outside of Drupal, as the function is designed for use in both Drupal and Pattern Lab.

Recommendations Update to version 1.1.1 or later of drupal/unified twig ext.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11570

GHSA-64MV-9655-37HX

Affected Products

Pattern Lab

Drupal-Pattern-Lab/Unified-Twig-Extensions

Drupal/Unified Twig Ext

References · 14

• https://osv.dev/vulnerability/CVE-2025-11570 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-64mv-9655-37hx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11570 · Security Note
• https://github.com/drupal-pattern-lab/unified-twig-extensions · Note
• https://github.com/drupal-pattern-lab/unified-twig-extensions/blob/862b9deccab544ca68e3aaaccc257d14acc9b1f6/example/_twig-components/functions/link.function.php%23L9 · Note
• https://security.snyk.io/vuln/SNYK-PHP-DRUPALPATTERNLABUNIFIEDTWIGEXTENSIONS-8400877 · Note
• https://twitter.com/CVEnew/status/1976517011942343128 · Twitter Post
• https://t.me/cveNotify/138092 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1976661008769831069 · Twitter Post
• https://drupal.org/sa-contrib-2023-041 · Note
• https://reddit.com/r/VulnMatter/comments/1o5knot/resumen_diario_de_vulnerabilidades_13102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o42xq1/resumen_diario_de_vulnerabilidades_11102025 · Reddit Post
• https://drupal.org/project/unified_twig_ext · Note
• https://reddit.com/r/VulnMatter/comments/1o425y4/resumen_diario_de_vulnerabilidades_11102025 · Reddit Post