Inline Formatter Field CVE-2026-107264

Exploitation requires an authenticated account with a role permitted to configure the Inline Formatter Field (PR:L), into which the attacker supplies crafted template-engine syntax that is later evaluated during rendering; this is not reachable by anonymous users against a default configuration. The specific template engine and exact trigger input are not described in the available sources. Limiting factors: the attacker must already hold the formatter/field-configuration privilege, impact is bounded to partial confidentiality and integrity (A:N), and exposure depends on how liberally the site delegates field-configuration permissions. Affected installations are those running Inline Formatter Field versions 0.0.0 through 4.2.0; updating per the vendor advisory is the remediation.

Signals are consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, base 5.4) describes a network-reachable, low-complexity flaw that nonetheless requires some level of authenticated privilege (PR:L) and yields only partial confidentiality and integrity impact (C:L/I:L/A:N). EPSS is low at 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit is identified, so there is no evidence of widespread or opportunistic exploitation. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with the low EPSS and absence of KEV. One point of tension worth flagging: the weakness class is template-engine code injection (CWE-1336 / SSTI), which in principle can escalate to arbitrary code execution, yet the vendor-aligned CVSS caps impact at Low/Low with scope unchanged - this suggests exploitation is gated behind a privileged role (e.g. a user permitted to configure the Inline Formatter Field) rather than being a full unauthenticated RCE. Treat as a real but contained issue: patch on a normal cycle, prioritizing sites that grant formatter/field-configuration permissions to semi-trusted users.

An authenticated Drupal user who holds a role permitted to configure the Inline Formatter Field supplies crafted template syntax into the field formatter configuration; when the field is rendered, the template engine evaluates the injected expression, allowing the attacker to inject code within the application context. No public exploit code is identified, and the precise trigger mechanism is not described in the available sources beyond the template-engine injection class.