PatchClock

PHP security digest · 7 Oct 2026

The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template inje...

Unrated CVE-2026-107264

Package
drupal/inline_formatter_field
Fixed in
4.2.0
Published
Wed 7 Oct 2026, 17:27 LisbonUpdated Mon 26 Oct 2026, 04:26 Lisbon

In plain words

The Inline Formatter Field module does not properly protect against template injection when parsing templates. This can allow users to render protected data or execute unsafe Twig commands.

Am I affected?

Look for drupal/inline_formatter_field and its version in composer.lock. The advisory lists 4.2.0 as fixed but gives no affected version range. Beyond the version, it names template parsing as the vulnerable operation, with no specific configuration or database condition to check.

What to do

Check which version you have, then update to a fixed release for your branch (4.2.0):

composer show drupal/inline_formatter_field | grep versions
composer update drupal/inline_formatter_field

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Inline Formatter Field module allows site builders to template and style entities with a field.

This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.