CVE-2026-126745: Drupal Real Name module Twig injection

CVE-2026-126745 · Severity: info · Published 2026-11-11

The Real Name module for Drupal displays user profiles with customizable name patterns built from user data. An authenticated attacker can inject Twig template syntax into their own profile fields and have it executed when their name is displayed, potentially exposing sensitive data or executing arbitrary code. This requires the site administrator to configure a name pattern that includes user-supplied data, and the attacker must have permission to edit their own profile.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126745 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126745 being exploited in the wild.
How severe is CVE-2026-126745?
Informational severity, published 11 November 2026.
Which products and versions are affected?
Drupal Real Name <2.0.1; Packagist:Https://Packages.Drupal.Org/8 Drupal/Realname ECOSYSTEM:introduced=0,fixed=2.0.1.
Is there a fix for CVE-2026-126745?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Realname: upgrade to 2.0.1 or later. Until then: Do not configure real name patterns that include user-supplied data fields, or restrict profile edit permissions to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126745 attacked?
It is attacked over the network.
Am I affected by CVE-2026-126745?
Check whether you run Drupal Real Name or Packagist:Https://Packages.Drupal.Org/8 Drupal/Realname at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Realname: upgrade to 2.0.1 or later

Do not configure real name patterns that include user-supplied data fields, or restrict profile edit permissions to trusted users only.

Technical details

The Real Name module fails to sanitize user input when rendering configurable name patterns that incorporate token-based user data. An authenticated user can inject Twig template syntax into their profile fields, which is then evaluated during display. This is a template injection vulnerability (CWE-1336) requiring user authentication and specific site configuration, but permits arbitrary code execution within the Twig sandbox.

Affected products

  • Drupal Real Name <2.0.1

Identifiers

  • CVE-2026-126745
  • DRUPAL-CONTRIB-2026-336

Timeline

  • 2026-11-11: disclosed: Security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.