SQL Injection Vulnerability in Drupal's CSP Log
CVE-2026-87938

Currently unrated

Key Information:

Vendor

Drupal
Status
Csp Log
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87938?

A vulnerability exists in Drupal's CSP log, where improper neutralization of special elements in an SQL command can lead to SQL Injection. This issue allows attackers to execute arbitrary SQL queries, potentially compromising the database and exposing sensitive information. The affected versions range from 0.0.0 to 1.0.2, highlighting the urgency for users to update their systems.

Affected Version(s)

CSP log 0.0.0 < 1.0.2

References

https://www.drupal.org/sa-contrib-2026-136

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

eduardo morales alberti
Ivo Van Geertruyen (mr.baileys)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Jess (xjm)
Swan Kalata (akalata)
.