DRUPAL-CONTRIB-2026-023
NoneCVSS
—
EPSS
—
Published
Mar 4, 2026
CISA due date
—
The record
This module extends the Drupal form API adding "Calculation element" form element types, which can evaluate a maths expression. It offers webform integration. The module doesn't sufficiently validate user input; this could be exploited to achieve Information Disclosure or Cross-site Scripting (XSS).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal/calculation_fields | 0 | 1.0.4 |