CVE-2026-114524: Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225
Published Oct 30, 2026
·Updated
Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.
Affected Software
1 affected component
Drupal Custom Formatters>=0.0.0<=4.2.1
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionWeakness
Nov 6, 2026
Data Sourced
via NVD·04:17 PM
Severity
Frequently Asked Questions
1
Which Custom Formatters installations are affected?
Custom Formatters versions from 0.0.0 through 4.2.1 are affected.
2
What is the impact of this issue?
The issue is described as a privilege-defined-with-unsafe-actions vulnerability that allows privilege escalation. The advisory title also characterizes the issue as critical remote code execution.