The Raw Formatter [Meta Tag Formatter] module could allow content that is not properly sanitized to be placed inside HTML meta tag attributes. The advisory does not specify the exact payload or the nature of the vulnerability, so the precise security consequence is uncertain. In general, unfiltered meta tag values may permit the injection of arbitrary code or data that could influence a user agent or downstream services.

All Drupal sites that have the Raw Formatter [Meta Tag Formatter] module enabled are potentially affected because the advisory lists "*.*" for the affected versions, indicating that every released version of the module is vulnerable unless a patched release has been issued. Sites that rely on this module to generate SEO or social media meta tags have a higher risk if the module cannot be removed or disabled.

The CVSS score of 5.9 signals a moderate level of severity, while the EPSS score of less than 1 % indicates a very low probability of widespread exploitation at present. The vulnerability is not referenced in CISA’s KEV catalog. The likely attack path involves an attacker who can provide or influence content that passes through the module to inject into meta tag values. Because the advisory does not provide detailed technical data, the exact exploitability and impact remain uncertain, but any injected data could potentially be rendered by user agents or processed by downstream systems.