SA-CONTRIB-2026-203: Critical severity drupal/inline_formatter_field vulnerability

Q: Is this a Drupal core issue or a contributed-module issue?

This advisory identifies the Inline Formatter Field contributed module for Drupal, not Drupal core.

Q: What should teams check first when triaging exposure?

Determine whether the Inline Formatter Field module is installed and used to template or style entities through a field. Deployments using that functionality should be prioritized because the issue occurs during template parsing.

Q: What could exploitation allow?

An attacker may be able to render protected data or execute unsafe Twig commands through template injection.

Q: Are affected versions, fixed versions, or temporary mitigations provided?

No affected-version range, fixed version, or workaround is included in the provided advisory data.

Published Oct 7, 2026

Updated

The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

drupal/inline_formatter_field<4.2.0

4.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/inline_formatter_field to a version that resolves this vulnerability.
Fixed in 4.2.0

Event History

Oct 7, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107264

Frequently Asked Questions

Is this a Drupal core issue or a contributed-module issue?

This advisory identifies the Inline Formatter Field contributed module for Drupal, not Drupal core.

What should teams check first when triaging exposure?

Determine whether the Inline Formatter Field module is installed and used to template or style entities through a field. Deployments using that functionality should be prioritized because the issue occurs during template parsing.

What could exploitation allow?

An attacker may be able to render protected data or execute unsafe Twig commands through template injection.

Are affected versions, fixed versions, or temporary mitigations provided?

No affected-version range, fixed version, or workaround is included in the provided advisory data.

SA-CONTRIB-2026-203: Critical severity drupal/inline_formatter_field vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Is this a Drupal core issue or a contributed-module issue?

What should teams check first when triaging exposure?

What could exploitation allow?

Are affected versions, fixed versions, or temporary mitigations provided?

Company

Resources

Contact

Frequently Asked Questions

Is this a Drupal core issue or a contributed-module issue?

What should teams check first when triaging exposure?

What could exploitation allow?

Are affected versions, fixed versions, or temporary mitigations provided?