CVE-2026-126760: Composer/drupal/datafield vulnerability
This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget.
The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting.
This vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The Search - autocomplete widget must also be configured on that field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/datafieldto a version that resolves this vulnerability.Fixed in 2.0.15 - Upgrade
Upgrade
composer/drupal/datafieldto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have permission to edit an entity that contains a Data Field field. They must be able to store a value that is later returned by the autocomplete endpoint.
Are all uses of the module affected?
No. The affected Data Field field must be configured to use the Search - autocomplete widget; the issue is mitigated when that widget is not configured.
What configuration should be reviewed during triage?
Identify entities with Data Field fields and determine whether any of those fields use the Search - autocomplete widget. Review which users or roles can edit those entities, since edit permission is required for exploitation.