Csv field: This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. (CVE-2026-114529)

The csv_field module for Drupal enables CSV file uploads and displays them as sortable and searchable tables. The vulnerability arises because the module does not properly escape CSV cell and header values before rendering them via the DataTables library, resulting in a potential XSS vulnerability. This flaw requires an attacker to have content creation or editing permissions that include CSV fields, limiting the attack surface. The affected versions are all versions prior to 2.0.10 and versions from 3.0.0 up to but not including 3.0.7. A patch is available to address this issue.

Successful exploitation could allow an attacker with content creation or editing permissions to inject malicious scripts via CSV data, potentially leading to cross-site scripting attacks against users viewing the affected content. However, the requirement for elevated permissions reduces the risk to general users.

A patch is available and should be applied to upgrade to versions 2.0.10 or later in the 2.x series, or 3.0.7 or later in the 3.x series. Until patched, restrict permissions to create or edit content containing CSV fields to trusted users only.