---
id: "CVE-2026-87938"
kind: "vulnerability"
aliases: ["CVE-2026-87938"]
title: "Drupal CSP log module: SQL injection via unsanitized input"
severity: "unknown"
cvss: null
epss: 0.00168
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:03+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T05:00:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87938", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87938", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal CSP log module: SQL injection via unsanitized input

The Drupal CSP log module contains an SQL injection flaw that lets an attacker alter database queries. The sources do not say which input triggers it or what data an attacker can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the CSP log module with `drush pm:list --filter=csp_log` or the Drupal extend page.
- Confirm whether the module is enabled on the site.

## Fix

- Upgrade the CSP log module to a version later than `1.0.2`; the sources do not name the fixed release.
- unknown

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87938
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87938

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_