This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a *Search - au…

This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a *Search - autocomplete* widget.

The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting.

This vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The *Search - autocomplete* widget must also be configured on that field.