Drupal CSV Field contains an improper neutralization of input during web page generation, allowing stored cross‑site scripting (XSS). An attacker can inject malicious JavaScript into CSV data that the module renders on web pages. The resulting code runs under the site’s user context, potentially enabling credential theft, session hijacking, or defacement of the affected site. This flaw is listed as CWE‑79.

The vulnerability affects Drupal CSV Field versions from 0.0.0 through 2.0.10 and from 3.0.0 through 3.0.7. Users running any of these releases are at risk.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. There is no CVSS score supplied in the data. The likely attack vector is via a stored CSV upload: an authenticated administrator or other user with import privileges could insert malicious content into the field, which is then rendered for all site visitors. As a stored XSS, exploitation requires access to the site interface that accepts CSV data and successful rendering of that data on subsequent requests.