{"id":"CVE-2026-107264","kind":"vulnerability","aliases":["CVE-2026-107264"],"related":[],"title":"Drupal Inline Formatter Field: template injection lets attackers inject code","description":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.","summary":"The Drupal Inline Formatter Field module does not neutralize special template-engine elements in its output, which is a code injection flaw. The sources say versions from 0.0.0 through 4.2.0 are affected, but do not say what an attacker can run or what input reaches the flaw.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Look for the `inline_formatter_field` module in the Drupal codebase (`composer show drupal/inline_formatter_field`) and compare the installed version with the affected range.","fix":"- Fixed version: unknown; the sources state only the affected range (up to `4.2.0`).","status":"open","published_at":"2026-10-30T04:17:56+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:32+00:00","updated_at":"2026-10-30T04:31:32+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:32Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown; the sources state only the affected range (up to `4.2.0`).","reach":"unknown","title":"Drupal Inline Formatter Field: template injection lets attackers inject code","impact":"high","summary":"The Drupal Inline Formatter Field module does not neutralize special template-engine elements in its output, which is a code injection flaw. The sources say versions from 0.0.0 through 4.2.0 are affected, but do not say what an attacker can run or what input reaches the flaw.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","cms"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown code injection in the rendered Drupal site","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, the trigger input, and whether authentication is required.","how_to_check":"- Look for the `inline_formatter_field` module in the Drupal codebase (`composer show drupal/inline_formatter_field`) and compare the installed version with the affected range.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that use the Inline Formatter Field module at a version in the affected range. The sources do not say which configurations or inputs trigger the flaw, so whether a given site is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4106,"output_tokens":534,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107264':13A,16A '-2026':12A,15A '0.0.0':49B,96C '4.2.0':51B,98C 'affect':53B,90C 'allow':85C 'attack':8A,60B 'cms':17B 'code':10A,41B,86C 'cve':11A,14A 'drupal':1A,18B,22B,81C 'element':34B,73C 'engin':33B,78C 'field':4A,25B,84C,93C 'flaw':43B,68B 'formatt':3A,24B,83C,92C 'improp':69C 'inject':6A,9A,42B,87C 'inlin':2A,23B,82C,91C 'input':65B 'issu':89C 'let':7A 'modul':26B 'neutral':29B,70C 'output':37B 'packag':19B 'php':20B 'reach':66B 'run':62B 'say':46B,57B 'sourc':45B 'special':30B,72C 'templat':5A,32B,77C 'template-engin':31B 'use':74C 'version':47B,94C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that use the Inline Formatter Field module at a version in the affected range. The sources do not say which configurations or inputs trigger the flaw, so whether a given site is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107264","severity":null,"published_at":"2026-10-30T04:17:56+00:00","modified_at":"2026-10-30T04:17:56+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}