The issue is an improperly controlled modification of dynamically‑determined object attributes (CWE‑915) in the Drupal Formatter Field module that allows an attacker to inject a PHP object. This flaw can enable the attacker to manipulate object properties, potentially leading to execution of arbitrary code or unauthorized data access. The upstream description identifies the weakness as a classic object injection scenario, which is known to be a high‑risk vulnerability.

Drupal Formatter Field module versions 0.0.0 through 2.0.0 are impacted. Any Drupal site running the module within this version range is at risk; the vulnerability does not affect other Drupal components or third‑party modules.

The CVSS base score is 9.8, indicating critical severity. The EPSS score is reported as less than 1%, suggesting very low but non‑zero exploitation probability at the time of this assessment. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through crafted web requests that trigger the Formatter Field processing logic. The precise exploitation pathway requires the attacker to control or influence data that the module uses to set object attributes, which is inferred from the nature of the flaw.