Improperly controlled modification of dynamically-determined object attributes in the Formatter Field module allows for Object Injection. This occurs because the module stores data as PHP-serialized strings, and if malicious data is written directly to the field, it can be triggered during the unserialization process. Exploitation requires the attacker to have permissions to edit a content entity with an attached `formatter field` field. Additionally, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", or the attacker must have an alternative method to edit field values directly.