{"id":"CVE-2026-87938","kind":"vulnerability","aliases":["CVE-2026-87938"],"related":[],"title":"Drupal CSP log module: SQL injection via unsanitized input","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.","summary":"The Drupal CSP log module contains an SQL injection flaw that lets an attacker alter database queries. The sources do not say which input triggers it or what data an attacker can reach.","severity":"unknown","cvss":null,"epss":0.00168,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the CSP log module with `drush pm:list --filter=csp_log` or the Drupal extend page.\n- Confirm whether the module is enabled on the site.","fix":"- Upgrade the CSP log module to a version later than `1.0.2`; the sources do not name the fixed release.\n- unknown","status":"open","published_at":"2026-10-22T02:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T05:00:36+00:00","updated_at":"2026-10-25T05:00:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:00:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the CSP log module to a version later than `1.0.2`; the sources do not name the fixed release.\n- unknown","reach":"unknown","title":"Drupal CSP log module: SQL injection via unsanitized input","impact":"high","summary":"The Drupal CSP log module contains an SQL injection flaw that lets an attacker alter database queries. The sources do not say which input triggers it or what data an attacker can reach.","category":"package","nicknames":[],"who_cares":["drupal","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads or changes database contents through injected SQL queries","analyst_note":"Find the Drupal security advisory for the CSP log module to confirm the fixed version, the vulnerable endpoint and whether authentication is required.","how_to_check":"- Check the installed version of the CSP log module with `drush pm:list --filter=csp_log` or the Drupal extend page.\n- Confirm whether the module is enabled on the site.","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the CSP log module at version `1.0.2` or earlier. The sources do not describe the exact configuration or the reachable endpoint, so whether an unauthenticated visitor can reach the flaw is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000586,"input_tokens":3340,"output_tokens":505,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-87938':12A,15A '0.0.0':81C '1.0.2':83C 'affect':76C 'allow':71C 'alter':35B 'attack':34B,51B 'command':63C 'contain':26B 'csp':2A,23B,69C,77C 'cve':10A,13A 'data':49B 'databas':36B 'drupal':1A,16B,22B,68C 'element':58C 'flaw':30B 'host':20B 'improp':54C 'inject':6A,29B,65C,73C 'input':9A,44B 'issu':75C 'let':32B 'log':3A,24B,70C,78C 'modul':4A,25B 'neutral':55C 'packag':17B 'queri':37B 'reach':53B 'say':42B 'self':19B 'self-host':18B 'sourc':39B 'special':57C 'sql':5A,28B,62C,64C,72C 'trigger':45B 'unsanit':8A 'use':59C 'version':79C 'via':7A 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the CSP log module at version `1.0.2` or earlier. The sources do not describe the exact configuration or the reachable endpoint, so whether an unauthenticated visitor can reach the flaw is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87938","severity":null,"published_at":"2026-10-22T02:17:03+00:00","modified_at":"2026-10-22T16:21:29+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87938","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87938","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}