CVE-2025-11570 – Drupal Pattern Lab Unified Twig Extensions Cross-site Scripting (XSS)

CVE ID : CVE-2025-11570

Published : Oct. 10, 2025, 5:15 a.m. | 1 hour, 22 minutes ago

Description : Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data.

**Note:**
This is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Pattern Lab.

The package drupal-pattern-lab/unified-twig-extensions is unmaintained, the fix for this issue exists in version 1.1.1 of [drupal/unified_twig_ext](https://www.drupal.org/project/unified_twig_ext)

Severity: 4.8 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…