CVE-2025-11570

MediumCVSS 4.6/10Last modified Oct 19, 2026

Description

Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data. **Note:** This is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Pattern Lab. The package drupal-pattern-lab/unified-twig-extensions is unmaintained, the fix for this issue exists in version 1.1.1 of [drupal/unified_twig_ext](https://www.drupal.org/project/unified_twig_ext)

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	drupal-pattern-lab/unified-twig-extensions	>= 0.0.0, < *

References

Timeline

Published: Oct 10, 2025
Last modified: Oct 19, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-115712.1Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to exec CVE-2025-115737.5An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a speciall CVE-2025-115757.8Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects Mongo CVE-2025-115764.3The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versi CVE-2025-115777.6Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Polic CVE-2025-115787.2A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root CVE-2025-115796.5github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an CVE-2025-11586.3A vulnerability was found in ESAFENET CDG 5.6.3.154.205_20250114. It has been classified as critical. Affected is an unknown function of the CVE-2025-115805.3A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes miss CVE-2025-115817.5A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of t CVE-2025-115829.8A vulnerability was detected in code-projects Online Job Search Engine 1.0. This issue affects some unknown processing of the file /registra CVE-2025-115839.8A flaw has been found in code-projects Online Job Search Engine 1.0. Impacted is an unknown function of the file /postjob.php. Executing man