# CVE-2026-126760: Drupal Data Field cross-site scripting in autocomplete

Source: https://junglewise.ai/threats/cve-2026-126760-drupal-contrib-2026-339-this-module-provides-a-field-type-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-126760 · Severity: info · Published 2026-11-11

The Data Field module for Drupal provides a widget for storing and searching structured data with multiple sub-fields. Its autocomplete search feature fails to properly escape field values before displaying them as suggestions, allowing attackers with entity editing permissions to inject malicious scripts that execute in other users' browsers. An attacker would need permission to edit entities using the Data Field and have the Search - autocomplete widget enabled on that field.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield](https://junglewise.ai/threats/technologies/drupal-datafield). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-126760 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126760 being exploited in the wild.

**How severe is CVE-2026-126760?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Drupal Data Field 2.0.0 through 2.0.14; 3.0.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield ECOSYSTEM:introduced=0,fixed=2.0.15|ECOSYSTEM:introduced=3.0.0,fixed=3.0.1.

**Is there a fix for CVE-2026-126760?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield: upgrade to 2.0.15 or later. Until then: Until upgrading, restrict entity editing permissions and disable or do not configure the Search - autocomplete widget on Data Field fields when used by untrusted users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126760 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126760?** Check whether you run Drupal Data Field or Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield: upgrade to 2.0.15 or later

Until upgrading, restrict entity editing permissions and disable or do not configure the Search - autocomplete widget on Data Field fields when used by untrusted users.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the autocomplete endpoint of the Data Field module. The endpoint returns field values as suggestion labels without sufficient HTML escaping, allowing an authenticated attacker to inject JavaScript. The vulnerability requires two preconditions: the attacker must have permission to edit an entity carrying a Data Field field, and the Search - autocomplete widget must be configured on that field.

## Affected products

- Drupal Data Field 2.0.0 through 2.0.14; 3.0.0

## Identifiers

- CVE-2026-126760
- DRUPAL-CONTRIB-2026-339

## Timeline

- 2026-11-11: disclosed

## References

- [https://www.drupal.org/u/mcdruid](https://www.drupal.org/u/mcdruid)
- [https://www.drupal.org/sa-contrib-2026-339](https://www.drupal.org/sa-contrib-2026-339)

## Related threats

- [Drupal Data Field cross-site scripting in file_uri formatter](https://junglewise.ai/threats/cve-2026-114555-drupal-contrib-2026-250-data-field-allows-you-to-create-custom)
- [Drupal Data field missing authorization in JSON endpoint](https://junglewise.ai/threats/cve-2026-81269-drupal-data-field-missing-authorization-in-json-endpoint)
- [DRUPAL-CONTRIB-2023-040 - The Data Field module provides a way of building field types that are made up of other…](https://junglewise.ai/threats/drupal-contrib-2023-040-the-data-field-module-provides-a-way-of-7dd3ec8b)