CVE-2026-12535

Name of the Vulnerable Software and Affected Versions Drupal Formatter Field versions 0.0.0 through 2.0.0

Description Improperly controlled modification of dynamically-determined object attributes in the Formatter Field module allows for Object Injection. This occurs because the module stores data as PHP-serialized strings, and if malicious data is written directly to the field, it can be triggered during the unserialization process. Exploitation requires the attacker to have permissions to edit a content entity with an attached formatter field field. Additionally, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", or the attacker must have an alternative method to edit field values directly.

Recommendations Update Drupal Formatter Field to a version later than 2.0.0. Restrict permissions to edit content entities that use the formatter field field. Disable the "Accept all JSON:API create, read, update, and delete operations" option in the JSON:API module.