CVE-2026-122073: XSS
The Name Field module provides a field for storing a personal name as separate components.
The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting (XSS) vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/nameto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Name Field module may be exposed where stored name values can later be rendered as HTML. The provided information does not identify specific roles, pages, or configurations that trigger the affected circumstances.
What would an attacker need to exploit it?
An attacker would need a way to store a crafted value in a Name Field and have that value rendered in a context where it is interpreted as HTML. This could result in cross-site scripting in a user's browser.
Can the available information confirm whether default configurations are affected?
No. The information states that insufficient sanitization occurs under some circumstances, but does not specify whether a default module or site configuration is affected.
How can an administrator determine whether the site is affected?
Confirm whether the site uses the Name Field module and review places where values from its fields are displayed. The provided information does not include affected versions, detection steps, or configuration conditions.