PatchClock

PHP security digest · 21 Oct 2026

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escap...

Unrated CVE-2026-114529

Package
drupal/csv_field
Fixed in
2.0.10, 3.0.7
Published
Wed 21 Oct 2026, 18:39 Lisbon

In plain words

The module does not sufficiently escape CSV cell and header values before passing them to the DataTables library, potentially allowing cross-site scripting. An attacker must have a role with permission to create or edit content that contains a CSV field.

Am I affected?

Look for drupal/csv_field and its version in composer.lock. Fixed versions listed are 2.0.10 and 3.0.7, but the advisory does not specify affected version ranges. Check whether your content contains CSV fields and which roles have permission to create or edit that content.

What to do

Check which version you have, then update to a fixed release for your branch (2.0.10, 3.0.7):

composer show drupal/csv_field | grep versions
composer update drupal/csv_field

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by the requirement that an attacker have a role with permission to create or edit content that contains a CSV field.

The advisory's description

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table.

The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content that contains a CSV field.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.