{"id":"CVE-2025-31682","aliases":["DRUPAL-CONTRIB-2025-011","EUVD-2025-9042","GHSA-36vv-q5jv-94cj"],"status":"published","title":"Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00236,"percentile":0.14747,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-01-29T17:13:29Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"Packagist","package":"drupal/google_tag","fixed_in":["1.8.0","2.0.8"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/google_tag","fixed_in":["1.8.0","2.0.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}]}],"products":[{"vendor":"drupal","product":"google tag"},{"vendor":"google_tag_project","product":"google_tag"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-011","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31682","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-36vv-q5jv-94cj"},{"url":"https://git.drupalcode.org/project/google_tag","tags":["web","package"]},{"url":"https://www.drupal.org/project/google_tag","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31682.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31682","title":"Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-03-31T21:40:33.099Z","modified":"2025-04-29T15:35:27.114Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-9042","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-03-31T21:40:33Z","modified":"2025-04-29T15:35:27Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-36vv-q5jv-94cj","title":"Drupal Google Tag Cross-Site Scripting (XSS) vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS). This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-04-29T20:19:13Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31682","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-03-31T22:15:20.767Z","modified":"2026-06-17T09:10:45.903Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:57.134561Z"}],"osv":[{"id":"CVE-2025-31682","title":"Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-03-31T21:40:33.099Z","modified":"2026-10-28T02:30:57.181581929Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-36vv-q5jv-94cj","title":"Drupal Google Tag Cross-Site Scripting (XSS) vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS). This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-12-10T23:41:10.821855Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"DRUPAL-CONTRIB-2025-011","description":"This module enables you to integrate the site with the Google Tag Manager (GTM) application.\n\nThe module doesn't have the \"restrict access\" flag on the \"administer google\\_tag\\_container\" permission. A user with this permission can load a GTM container that completely changes the page or inserts malicious JS, resulting in a cross site scripting vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the aforementioned permission.","status":"published","published":"2025-01-29T17:13:29Z","modified":"2026-09-10T03:45:54.720349941Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}