CVE-2026-107264
The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against tem...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The Inline Formatter Field module allows site builders to template and style entities with a field.
This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands.
影響パッケージ
Packagist:https://packages.drupal.org/8
drupal/inline_formatter_field
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}],"database_specific":{"constraint":"<4.2.0"}}]
参照URL
- web drupal.org