An unescaped user input in the Drupal SAML SSO - Service Provider module allows cross‑site scripting when a web page is generated. An attacker could inject malicious scripts that run in the context of a legitimate user, enabling session hijacking, defacement, or credential theft. The vulnerability is classified as a standard cross‑site scripting flaw per CWE‑79.

Systems affected are installations of the Drupal SAML SSO - Service Provider module, versions from the initial release up through 3.1.2. The module is a contributed component for the Drupal content management system. Any site using older versions without the patch is vulnerable.

The CVSS v3.1 score of 6.1 indicates moderate severity, and the low EPSS score (<1%) suggests exploitation is presently unlikely but still possible. It is not listed in the CISA KEV catalog. The attack vector is web‑based; an attacker needs a browser context to deliver the payload, typically by persuading a user to visit a crafted URL or interaction with a page that processes untrusted input. Because the flaw is a typical reflected or stored XSS, success requires that the vulnerable input be reflected or stored on a page served to the user. Once injected, the attacker could execute arbitrary JavaScript inside that user's browser session.