Project: 
CSV Field
Project machine name: 
csv_field
Date: 
2026-October-21
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross site Scripting
Affected versions: 
<2.0.10 || >=3.0.0 <3.0.7
CVE IDs: 
CVE-2026-114529
Description: 

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table.

The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content that contains a CSV field.

Solution: 

Install the latest version:

CSV Field 1.0.x is no longer supported and does not receive security coverage. Sites still on 1.0.x should upgrade to a supported branch.

Reported By: 
Fixed By: 
Coordinated By: