Improper neutralization of special elements used in a template engine allows code injection. The module fails to sufficiently separate field content from template code during the rendering of linked field output. Depending on the installed Twig extensions, this can be used to expose site configuration values, including sensitive data such as credentials or API keys. Exploitation requires the attacker to possess a role with permissions to create or edit content in a field where Linked Field is enabled in the display settings.