SA-CONTRIB-2026-136: SQL Injection
The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers. The module did not sufficiently sanitize user-supplied values used in database queries, resulting in an SQL injection vulnerability. This vulnerability is mitigated by the fact that an attacker needs access to an account with the Access CSP reports permission to exploit the SQL Injection.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/csp_logto a version that resolves this vulnerability.Fixed in 1.0.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an account with the Access CSP reports permission. The provided information does not indicate that unauthenticated users can exploit it.
What capability does a successful attacker need?
The attacker must be able to supply values that are used in database queries through functionality accessible with the Access CSP reports permission.