The vulnerability is an SQL injection flaw arising from improper neutralization of special elements used in an SQL command. A malicious actor who can influence the input processed by the CSP log module could inject arbitrary SQL, allowing the attacker to view, modify, or delete database contents. The weakness is classified as CWE‑89, which denotes unsanitized input leading to injection.

Drupal CSP log versions ranging from the initial release 0.0.0 through 1.0.2 are affected. Sites running any of those versions are vulnerable until a new release is deployed.

The CVSS score is 6.5, indicating moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through a web‑exposed form or input field that the module processes, as the injection path requires user‑controlled input to reach the SQL statement.