CVE-2026-12535: Object Injection Vulnerability in Drupal Formatter Field Package
Summary
CVE-2026-12535: The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. Affects drupal/formatter_field versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Formatter Field module in Drupal allows users to specify formatters and settings for displaying fields on a per-entity basis. This module is essential for customizing how content is presented, enhancing the user experience. However, it has a critical vulnerability that can be exploited if not properly managed.
Vulnerability Detail
The Formatter Field module stores data as PHP-serialized strings. In certain scenarios, an attacker can inject malicious data directly into the field, leading to an Object Injection vulnerability when the data is unserialized. This vulnerability requires the attacker to have permission to edit a content entity with an attached formatter_field field. Additionally, the core JSON:API module must be enabled with the option 'Accept all JSON:API create, read, update, and delete operations', which is not enabled by default. If exploited, this vulnerability can allow attackers to execute arbitrary code, potentially compromising the entire application.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict permissions for users who can edit content entities with the formatter_field field. This can help mitigate the risk until the package is updated.
Conclusion
The CVE-2026-12535 vulnerability in the Drupal Formatter Field package poses a significant risk due to its potential for Object Injection. It is crucial for users to update to version 2.0.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/formatter_field →
FAQ
The Formatter Field module in Drupal allows for customized display settings for fields on a per-entity basis, enhancing content presentation.
An Object Injection vulnerability occurs when an attacker can manipulate serialized data, potentially leading to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider restricting user permissions for editing content entities with the formatter_field field as a temporary measure.
While updating the package should not cause data loss, it is always recommended to back up your application before performing any updates.
