Intel

CVE-2026-12535

drupal/formatter_field: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-2026-12535)

criticalEPSS 0.6%

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

Source: NVD (NIST)cvelistv5OSV (Open Source Vulnerabilities)BSI WID PortalBSI CSAF

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

packagist:https://packages.drupal.org/8drupal/formatter_field

Metrics

XIEM Effective CVSS
9.8
Source: nvd-v3
EPSS percentile
45.2 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
87.19
Exploit maturity
no public PoC known
CVSS v3
9.8
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-10 21:43 UTC
CWE
CWE-915

Weakness classes (CWE)

  • CWE-915Base

    Improperly Controlled Modification of Dynamically-Determined Object Attributes

    The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

    cwe.mitre.org →

References & sources

Linked advisories