CVE-2026-107264
The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against tem...
Original description
The description as published by the source.
The Inline Formatter Field module allows site builders to template and style entities with a field.
This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/inline_formatter_field
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}],"database_specific":{"constraint":"<4.2.0"}}]
References
- web drupal.org