Project:
Date:
2026-March-04
Security risk:
Vulnerability:
Cross-site Scripting
Affected versions:
<1.0.4
CVE IDs:
CVE-2026-3528
Description:
This module extends the Drupal form API adding "Calculation element" form element types, which can evaluate a maths expression. It offers webform integration.
The module doesn't sufficiently validate user input; this could be exploited to achieve Information Disclosure or Cross-site Scripting (XSS).
Solution:
Install the latest version:
- If you use the Calculation fields module, upgrade to Calculation fields 1.0.4
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
Fixed By:
Coordinated By:
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
