Inline Formatter Field
Monthly
Code injection in the Drupal contributed module Inline Formatter Field (versions 0.0.0 through 4.2.0) allows a user who is permitted to configure the field formatter to supply crafted template-engine syntax that is evaluated when the field is rendered, giving partial confidentiality and integrity impact (CVSS 3.1: 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The flaw is not reachable by anonymous users in a default configuration; the attacker must already hold the formatter/field-configuration privilege, so real-world exposure depends on how liberally a site delegates that permission. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.18% (7th percentile), and the vendor has released a patch, pointing to a moderate, this-month priority rather than an emergency.
Code injection in the Drupal contributed module Inline Formatter Field (versions 0.0.0 through 4.2.0) allows a user who is permitted to configure the field formatter to supply crafted template-engine syntax that is evaluated when the field is rendered, giving partial confidentiality and integrity impact (CVSS 3.1: 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The flaw is not reachable by anonymous users in a default configuration; the attacker must already hold the formatter/field-configuration privilege, so real-world exposure depends on how liberally a site delegates that permission. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.18% (7th percentile), and the vendor has released a patch, pointing to a moderate, this-month priority rather than an emergency.