CVE-2025-10926: 
PHP vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability has been identified in Drupal JSON Field module, tracked as CVE-2025-10926. The vulnerability affects all versions of JSON Field from 0.0.0 before version 1.5. This security issue was disclosed on October 29, 2025, and received a CVSS v3.1 base score of 6.1 (Medium) (NVD).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It allows for Cross-Site Scripting (XSS) attacks through the JSON Field module. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impact on both confidentiality and integrity, and no impact on availability (NVD, AttackerKB).

The vulnerability could allow attackers to execute malicious scripts in the context of the user's browser session, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The CVSS scoring indicates low impact on both confidentiality and integrity of the system (NVD).

Users should upgrade JSON Field to version 1.5 or later to address this vulnerability. The fix has been released as part of the security update (NVD).