Drupal Obfuscate Vulnerable to Stored Cross-Site Scripting (XSS)

MEDIUM 5.4CVE-2025-3130 · DRUPAL-CONTRIB-2025-029 · GHSA-hphm-3x7f-g875 · Published 02/04/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
drupal/obfuscate Packagist	`< 2.0.1`	`2.0.1`
drupal/obfuscate Packagist:https://packages.drupal.org/8	`< 2.0.1`	`2.0.1`
obfuscate drupal	`< 2.0.1`	`2.0.1`

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS. This issue affects Obfuscate: from 0.0.0 before 2.0.1.

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.

References

nvd.nist.gov/vuln/detail/CVE-2025-3130 · ADVISORY
git.drupalcode.org/project/obfuscate · PACKAGE
drupal.org/sa-contrib-2025-029 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free