Code Injection Vulnerability in Drupal Inline Formatter Field
CVE-2026-107264

Currently unrated

Key Information:

Vendor: Drupal
Status: Inline Formatter Field
Vendor: CVE Published:; 30 October 2026

What is CVE-2026-107264?

A vulnerability exists in the Drupal Inline Formatter Field that allows for code injection due to improper neutralization of special elements used within a template engine. This flaw poses a serious risk as it can enable attackers to execute arbitrary code on affected installations. Users and administrators of affected versions, specifically from 0.0.0 to 4.2.0, should take immediate action to mitigate potential exploitation.

Affected Version(s)

Inline Formatter Field 0.0.0 < 4.2.0

References

https://www.drupal.org/sa-contrib-2026-203

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 30, 2026
Vulnerability Reserved
Oct 7, 2026

Credit

Marcus Johansson (marcus_johansson)

Bobby Saul (bobbysaul)

Swan Kalata (akalata)

Greg Knaddison (greggles)

Juraj Nemec (poker10)

CVE-2026-107264 Data

JSON