Live › vulnerability › CVE-2026-114555
The Drupal Data field module does not neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can save content through the field can run scripts in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal with the Data field module at version 2.0.14 or earlier are exposed. The sources do not describe which roles can write to the field, so the team should check who can enter content there. Sites that do not use the Data field module can skip it.
No product ranges from the sources yet.
drush pm:list or the Drupal extend page) and see whether it is 2.0.14 or earlier.0.0.0 to 2.0.14, not a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.
This page as .md · .json · in your agent: get_signal("CVE-2026-114555")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.