SA-CONTRIB-2026-339: Critical severity composer/drupal/datafield vulnerability
This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget. The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting. This vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The Search - autocomplete widget must also be configured on that field.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/datafieldto a version that resolves this vulnerability.Fixed in 3.0.1Fixed in 2.0.15
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using composer/drupal/datafield are exposed only where a Data Field field is configured with the Search - autocomplete widget. Exploitation also requires an attacker to have permission to edit an entity that carries that field.
What must an attacker do to exploit it?
The attacker must be able to store a crafted value in a Data Field field on an editable entity. When that value is returned by the affected autocomplete endpoint as a suggestion label, insufficient escaping can allow cross-site scripting.