Cross-Site Scripting Vulnerability in Drupal CSV Field
CVE-2026-114529

Currently unrated

Key Information:

Vendor

Drupal
Status
Csv Field
Vendor
CVE Published:
30 October 2026

What is CVE-2026-114529?

The Drupal CSV Field component is affected by a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker could exploit this flaw to execute arbitrary JavaScript in the context of the victim’s browser, potentially compromising user data or hijacking user sessions. The vulnerability affects CSV Field versions from 0.0.0 to 2.0.10 and from 3.0.0 to 3.0.7, making it crucial for users operating these versions to apply necessary patches to mitigate risks.

Affected Version(s)

CSV Field 0.0.0 < 2.0.10

CSV Field 3.0.0 < 3.0.7

References

https://www.drupal.org/sa-contrib-2026-226

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Dima Storozhuk (dstorozhuk)
Thomas Fleming (thomas.fleming)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.