Threats tagged 'drupal-contrib-2026-336'

The Drupal Realname module allows displaying user names based on configurable patterns using tokens. A vulnerability exists where user input used in these patterns is not properly sanitized, enabling an attacker to inject and have Twig syntax evaluated when their name is displayed. Exploitation requires the site to be configured with a real name pattern that includes user-supplied data and the attacker to have the ability to edit their own profile data. This issue is fixed in version 2.0.1 of the module.