AIKIDO-2026-438989

TL;DR

Formie's anti-template-injection guard for populated field values uses a single-pass str_replace that does not re-scan its own output, so nested Twig delimiters such as {{{{7*7}}}} collapse back into an executable expression. A custom-default Hidden field then renders that value through Craft's unsandboxed view engine, so values supplied through the populateFormValues map (via the GraphQL templateHtml argument or the craft.formie.populateFormValues Twig variable) reach server-side Twig. Externally influenced input can therefore trigger information disclosure, application state changes, and potential remote code execution. The fix strips delimiters until stable and parses Hidden custom defaults through the sandboxed Variables engine.