Linked Field
Monthly
Server-side template injection in the Drupal contributed module Linked Field (versions 0.0.0 through 1.8.0, fixed in 1.8.0) allows an authenticated user who holds the permission to configure the module's formatter/display settings to supply template syntax that the site then evaluates in its own server context, enabling code injection. This is a moderate-priority issue rather than an emergency: EPSS is 0.18% (7th percentile), there is no CISA KEV entry, and no public exploit has been identified at time of analysis. The vendor has released a patch, and the practical exposure is limited to sites that grant this administrative-style configuration permission to users beyond a small trusted set.
Server-side template injection in the Drupal contributed module Linked Field (versions 0.0.0 through 1.8.0, fixed in 1.8.0) allows an authenticated user who holds the permission to configure the module's formatter/display settings to supply template syntax that the site then evaluates in its own server context, enabling code injection. This is a moderate-priority issue rather than an emergency: EPSS is 0.18% (7th percentile), there is no CISA KEV entry, and no public exploit has been identified at time of analysis. The vendor has released a patch, and the practical exposure is limited to sites that grant this administrative-style configuration permission to users beyond a small trusted set.