DRUPAL-CONTRIB-2026-339: Composer/drupal/datafield vulnerability

Q: Who is realistically exposed to this issue?

Sites are exposed only where a Data Field field uses the Search - autocomplete widget. An attacker must also have permission to edit an entity that carries that Data Field field.

Q: What conditions are required for exploitation?

The attacker needs to be able to store a crafted field value in an editable Data Field field, and the affected field must be configured with the Search - autocomplete widget. The autocomplete endpoint then returns the stored value as a suggestion label without sufficient escaping.

Q: How can I determine whether my site is affected?

Review Data Field field configurations and identify any using the Search - autocomplete widget. Then determine whether users who could act maliciously have permission to edit entities containing those fields.

Published Nov 11, 2026

Updated

This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget.

The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting.

This vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The Search - autocomplete widget must also be configured on that field.

Affected Software

2 affected componentsFixes available

composer/drupal/datafield<2.0.15

2.0.15

composer/drupal/datafield>=3.0.0<3.0.1

3.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/datafield to a version that resolves this vulnerability.
Fixed in 2.0.15
Upgrade
Upgrade composer/drupal/datafield to a version that resolves this vulnerability.
Fixed in 3.0.1

Event History

Nov 11, 2026

Advisory Published

via OSV·06:08 PM

Data Sourced

via OSV·06:08 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Sites are exposed only where a Data Field field uses the Search - autocomplete widget. An attacker must also have permission to edit an entity that carries that Data Field field.

What conditions are required for exploitation?

The attacker needs to be able to store a crafted field value in an editable Data Field field, and the affected field must be configured with the Search - autocomplete widget. The autocomplete endpoint then returns the stored value as a suggestion label without sufficient escaping.

How can I determine whether my site is affected?

Review Data Field field configurations and identify any using the Search - autocomplete widget. Then determine whether users who could act maliciously have permission to edit entities containing those fields.

DRUPAL-CONTRIB-2026-339: Composer/drupal/datafield vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What conditions are required for exploitation?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What conditions are required for exploitation?

How can I determine whether my site is affected?