Project:
Project machine name:
datafieldDate:
2026-November-11
Security risk:
Vulnerability:
Cross-site scripting
Affected versions:
<2.0.15 || >=3.0.0 <3.0.1
CVE IDs:
CVE-2026-126760
Description:
This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget.
The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting.
This vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The Search - autocomplete widget must also be configured on that field.
Solution:
Install the latest version:
- If you use Data Field 3.0.x, upgrade to Data Field 3.0.1.
- If you use Data Field 2.0.x, upgrade to Data Field 2.0.15.
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
