Drupal · Formatter Field · CVE-2026-12535
**Name of the Vulnerable Software and Affected Versions**
Drupal Formatter Field versions 0.0.0 through 2.0.0
**Description**
Improperly controlled modification of dynamically-determined object attributes in the Formatter Field module allows for Object Injection. This occurs because the module stores data as PHP-serialized strings, and if malicious data is written directly to the field, it can be triggered during the unserialization process. Exploitation requires the attacker to have permissions to edit a content entity with an attached `formatter field` field. Additionally, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", or the attacker must have an alternative method to edit field values directly.
**Recommendations**
Update Drupal Formatter Field to a version later than 2.0.0.
Restrict permissions to edit content entities that use the `formatter field` field.
Disable the "Accept all JSON:API create, read, update, and delete operations" option in the JSON:API module.