CVE-2026-126760

This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget.

The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting.

This vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The Search - autocomplete widget must also be configured on that field.