AIKIDO-2026-607428

TL;DR

The Linked Field module links a field's rendered output to a URL or to the value of another field. Affected versions pass that rendered HTML, which includes user-provided field content, to Drupal's inline_template render element, so the field value is compiled as Twig instead of being printed as text. Depending on the Twig extensions installed on the site, this can expose site configuration values, which may include sensitive information such as API keys or credentials. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content in a field that has Linked Field enabled in its display settings.