-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper attribute handling in Formatter Suite's link field formatter. While the exact code diff isn't available, the security advisory explicitly:
In Drupal architecture, field formatters implement viewElements() to render field values. The FormatterSuiteLinkFormatter would be responsible for building link render arrays, including handling attributes. Before the patch, this method likely passed raw user-controlled attributes to the render system without adequate filtering, which would appear in profilers when rendering vulnerable link fields.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/formatter_suite | composer | < 2.1.0 | 2.1.0 |