DRUPAL-CONTRIB-2022-027
The GOV.UK Theme (govuk_theme) is a Drupal theme for the GOV.UK Design System.
The theme doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting (XSS) vulnerabilities. An attacker that can create or edit certain entities or configuration may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities to target visitors of the site, including site admins with privileged access.
The vulnerability is mitigated by the facts, that:
- An attacker must have one of several permissions, of which at least some are commonly only assigned to either editors, site builders or administrators.
- For some of the vulnerabilities, certain contributed modules must be enabled.
What each source reports
OSV No score
The GOV.UK Theme (govuk_theme) is a Drupal theme for the GOV.UK Design System.
The theme doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting (XSS) vulnerabilities. An attacker that can create or edit certain entities or configuration may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities to target visitors of the site, including site admins with privileged access.
The vulnerability is mitigated by the facts, that:
- An attacker must have one of several permissions, of which at least some are commonly only assigned to either editors, site builders or administrators.
- For some of the vulnerabilities, certain contributed modules must be enabled.
- Record
DRUPAL-CONTRIB-2022-027- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/govuk_themePackagist:https://packages.drupal.org/8 |
before 1.9.0 | 1.9.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2022-027 is a vulnerability with no CVSS score yet in drupal/govuk_theme, published February 23, 2022. No source lists public exploit code. Fixed in drupal/govuk_theme 1.9.0.