This vulnerability (CVE-2026-12535) in the Drupal Formatter Field module is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). It allows an attacker to perform object injection by exploiting insufficient control over object attribute modification. The affected versions include all releases from 0.0.0 through 2.0.0. The CVSS 3.1 base score of 9.8 reflects a critical risk with network attack vector, no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of the affected system, including unauthorized disclosure of information, modification of data, and disruption of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Drupal security advisories for updates and consider applying temporary mitigations if recommended by the vendor.