{"id":"CVE-2026-114555","kind":"vulnerability","aliases":["CVE-2026-114555"],"related":[],"title":"Drupal Data field module: stored XSS lets page content run scripts","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.","summary":"The Drupal Data field module does not neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can save content through the field can run scripts in other visitors' browsers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","web-cms"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Drupal Data field module (for example with `drush pm:list` or the Drupal extend page) and see whether it is `2.0.14` or earlier.\n- Confirm whether the site uses the Data field module at all.","fix":"- Data field module: unknown; the sources only state the affected range `0.0.0` to `2.0.14`, not a fixed version.","status":"open","published_at":"2026-10-30T04:18:16+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:43+00:00","updated_at":"2026-10-30T04:29:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T04:29:43Z","model":"claude-haiku-5-5","output":{"fix":"- Data field module: unknown; the sources only state the affected range `0.0.0` to `2.0.14`, not a fixed version.","reach":"internet","title":"Drupal Data field module: stored XSS lets page content run scripts","impact":"medium","summary":"The Drupal Data field module does not neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can save content through the field can run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","web-cms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers, potentially stealing sessions or data.","analyst_note":"Confirm the fixed version and the required write permission from the NVD entry or the Drupal security advisory for the Data field module.","how_to_check":"- Check the installed version of the Drupal Data field module (for example with `drush pm:list` or the Drupal extend page) and see whether it is `2.0.14` or earlier.\n- Confirm whether the site uses the Data field module at all.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running Drupal with the Data field module at version 2.0.14 or earlier are exposed. The sources do not describe which roles can write to the field, so the team should check who can enter content there. Sites that do not use the Data field module can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4104,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114555':14A,17A '-2026':13A,16A '0.0.0':85C '2.0.14':87C 'affect':80C 'allow':36B,75C 'attack':43B 'browser':57B 'cms':22B 'content':9A,47B 'cross':39B,67C 'cross-sit':38B,66C 'cve':12A,15A 'data':2A,25B,73C,81C 'drupal':1A,18B,24B,72C 'field':3A,26B,50B,74C,82C 'generat':33B,65C 'improp':58C 'input':31B,61C 'issu':79C 'let':7A 'modul':4A,27B 'neutral':30B,59C 'packag':19B 'page':8A,35B,64C 'run':10A,52B 'save':46B 'script':11A,41B,53B,69C 'site':40B,68C 'store':5A,37B,76C 'version':83C 'visitor':56B 'vulner':70C 'web':21B,34B,63C 'web-cm':20B 'xss':6A,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal with the Data field module at version 2.0.14 or earlier are exposed. The sources do not describe which roles can write to the field, so the team should check who can enter content there. Sites that do not use the Data field module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114555","severity":null,"published_at":"2026-10-30T04:18:16+00:00","modified_at":"2026-10-30T04:18:16+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}