CVE-2026-12535

CriticalCVSS 9.8

Published: 10/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal Formatter Field allows object injection. This affects versions from 0.0.0 to 2.0.0.

Risk Assessment

An attacker can remotely inject a malicious object, potentially leading to arbitrary code execution or full system compromise of the Drupal instance.

Recommendation

Immediately update the Formatter Field module to version 2.0.1 or later if available. In the meantime, restrict module access to trusted users only.

Original NVD description (English source)

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.