SA-CONTRIB-2026-226: Critical severity drupal/csv_field vulnerability

Q: Who can exploit this issue?

An attacker must have a role that can create or edit content containing a CSV field. Users without that permission cannot directly supply the CSV cell or header values involved.

Q: What content needs to be treated as untrusted?

Both CSV cell values and CSV header values can reach the interactive table output without sufficient escaping. CSV uploaded or edited by users with the relevant content permissions should be considered potentially unsafe.

Published Oct 21, 2026

Updated

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content that contains a CSV field.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

drupal/csv_field<3.0.7, <2.0.10

3.0.72.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/csv_field to a version that resolves this vulnerability.
Fixed in 3.0.7Fixed in 2.0.10

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114529

Frequently Asked Questions

Who can exploit this issue?

An attacker must have a role that can create or edit content containing a CSV field. Users without that permission cannot directly supply the CSV cell or header values involved.

What content needs to be treated as untrusted?

Both CSV cell values and CSV header values can reach the interactive table output without sufficient escaping. CSV uploaded or edited by users with the relevant content permissions should be considered potentially unsafe.

SA-CONTRIB-2026-226: Critical severity drupal/csv_field vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What content needs to be treated as untrusted?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What content needs to be treated as untrusted?