View online: https://www.drupal.org/sa-contrib-2026-226 Project: CSV Field [1] Project machine name: csv_field Date: 2026-October-21 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site Scripting Affected versions: <2.0.10 || >=3.0.0 <3.0.7 CVE IDs: CVE-2026-114529 Description: This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content that contains a CSV field. Solution: Install the latest version: * If you use the CSV Field 3.0.x, upgrade to CSV Field 3.0.7 [3] * If you use the CSV Field 2.0.x, upgrade to CSV Field 2.0.10 [4] CSV Field 1.0.x is no longer supported and does not receive security coverage. Sites still on 1.0.x should upgrade to a supported branch. Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Dima Storozhuk (dstorozhuk) [6] * Thomas Fleming (thomas.fleming) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/csv_field [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/csv_field/releases/3.0.7 [4] https://www.drupal.org/project/csv_field/releases/2.0.10 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/dstorozhuk [7] https://www.drupal.org/u/thomasfleming [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....