{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-9550","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-9550\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-9550\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/2348769","id":"2348769","resource":"node"},"field_sa_advisory_id":"100","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/damienmckenna\u0022 rel=\u0022nofollow\u0022\u003EDamien McKenna (damienmckenna)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mrbaileys\u0022 rel=\u0022nofollow\u0022\u003EIvo  Van Geertruyen (mr.baileys)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E, provisional member of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mcdruid\u0022 rel=\u0022nofollow\u0022\u003EDrew Webber (mcdruid)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:Admin\/CI:Some\/II:Some\/E:Theoretical\/TD:All","field_sa_description":{"value":"\u003Cp\u003EThis module enables you to to easily create and manage faceted search interfaces.\u003C\/p\u003E\n\u003Cp\u003EThe module doesn\u2019t sufficiently filter certain user-provided text leading to a cross site scripting (XSS) vulnerability.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \u201cadminister facets\u201d.\u003C\/p\u003E\n\u003Cp\u003E\u003Cstrong\u003ECVSS risk score (\u003Ca href=\u0022https:\/\/www.drupal.org\/project\/securitydrupalorg\/issues\/3442181\u0022 rel=\u0022nofollow\u0022\u003Eexperimental\u003C\/a\u003E) 4.8 \/ Medium\u003C\/strong\u003E\u003C\/p\u003E\n\u003Cp\u003E\u003Ca href=\u0022https:\/\/www.first.org\/cvss\/calculator\/4-0#CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:H\/UI:P\/VC:N\/VI:L\/VA:N\/SC:L\/SI:N\/SA:N\u0022 rel=\u0022nofollow\u0022\u003ECVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:H\/UI:P\/VC:N\/VI:L\/VA:N\/SC:L\/SI:N\/SA:N\u003C\/a\u003E\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/borisson_\u0022 rel=\u0022nofollow\u0022\u003EJoris Vercammen (borisson_)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/drunken-monkey\u0022 rel=\u0022nofollow\u0022\u003EThomas Seidl (drunken monkey)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E, provisional member of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the Facets module for Drupal 8.x or higher, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/facets\/releases\/2.0.10\u0022 rel=\u0022nofollow\u0022\u003EFacets 2.0.10\u003C\/a\u003E or \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/facets\/releases\/3.0.1\u0022 rel=\u0022nofollow\u0022\u003EFacets 3.0.1\u003C\/a\u003E\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Cross Site Scripting","field_issue_last_status_change":"1756315391","field_sa_cve":["CVE-2025-9550"],"field_is_psa":"0","field_affected_versions":"\u003C2.0.10 || \u003E=3.0.0 \u003C3.0.1","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3543173","id":"3543173","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3543174","id":"3543174","resource":"node"}],"nid":"3543297","vid":"14102295","is_new":false,"type":"sa","title":"Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2025-100","edit_url":"https:\/\/www.drupal.org\/node\/3543297\/edit","status":"1","promote":"0","sticky":"0","created":"1756315185","changed":"1756315391","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16242905","id":16242905,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16242906","id":16242906,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16242907","id":16242907,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16242908","id":16242908,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16242909","id":16242909,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16243014","id":16243014,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1756315185"}]}