PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87938 Drupal CVE debrief

A SQL Injection vulnerability exists in the Drupal CSP log module versions from 0.0.0 to 1.0.2. This issue allows attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification. The vulnerability was published on October 22, 2026, and the CVE record was last modified on October 30, 2026. Drupal users who have installed the CSP log module, especially those using versions prior to 1.0.2, should assess their exposure and consider updating the module to prevent potential SQL injection attacks. The vulnerability can lead to unauthorized data access or modification, and potentially disrupt service.

Vendor
Drupal
Product
CSP log
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-30
Advisory published
2026-10-22
Advisory updated
2026-10-30

Who should care

Drupal users who have installed the CSP log module, especially those using versions prior to 1.0.2, should assess their exposure and consider updating the module to prevent potential SQL injection attacks.

Why it matters

The SQL Injection vulnerability in the Drupal CSP log module requires immediate attention from Drupal users who have installed the module. The vulnerability can lead to unauthorized data access or modification, and potentially disrupt service. Users should review and update the module to version 1.0.2 or later, and implement additional security measures to detect and prevent SQL injection attacks.

  • Potential unauthorized data access or modification due to SQL injection
  • Possible disruption of service due to exploitation of the vulnerability

Technical summary

The Drupal CSP log module is vulnerable to SQL Injection attacks due to improper neutralization of special elements used in SQL commands. This vulnerability affects versions from 0.0.0 to 1.0.2 of the module. The issue arises from the module's failure to properly sanitize user input, allowing attackers to inject malicious SQL code. To mitigate this vulnerability, users should review and update the CSP log module to version 1.0.2 or later and implement additional security measures to detect and prevent SQL injection attacks.

Defensive priority

High

Recommended defensive actions

  • Review and update the CSP log module to version 1.0.2 or later
  • Implement additional security measures to detect and prevent SQL injection attacks
  • Monitor the Drupal CSP log module for any suspicious activity

Evidence notes

The CVE record and source item provide details about the SQL Injection vulnerability in the Drupal CSP log module. The vulnerability affects versions from 0.0.0 to 1.0.2. However, the record does not provide information on known exploitation or specific attack vectors.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87938 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87938

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87938 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87938

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.