Live › vulnerability › CVE-2026-107259
The Drupal Linked Field module fails to neutralize special elements used in a template engine, which allows code injection. Affected versions are listed as 0.0.0 through 1.8.0 in the source.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal with the Linked Field module in the listed version range are in scope. The sources do not say whether a default configuration or a logged-in account is needed to trigger the flaw, so the exposure of any given site is unknown.
No product ranges from the sources yet.
drush pm:list or the module list at /admin/modules0.0.0 to 1.8.0No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107259")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.