Live › vulnerability › CVE-2026-107264
The Drupal Inline Formatter Field module does not neutralize special template-engine elements in its output, which is a code injection flaw. The sources say versions from 0.0.0 through 4.2.0 are affected, but do not say what an attacker can run or what input reaches the flaw.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that use the Inline Formatter Field module at a version in the affected range. The sources do not say which configurations or inputs trigger the flaw, so whether a given site is exposed is unknown.
No product ranges from the sources yet.
inline_formatter_field module in the Drupal codebase (composer show drupal/inline_formatter_field) and compare the installed version with the affected range.4.2.0).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107264")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.