Real Name security updates, in plain English

Real Name

15,544 sites report using it · on drupal.org · 1 security update explained here

This module lets a site display users by a custom name built from their profile data instead of their username.

Below is every security update for Real Name that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

Real Name

Moderately critical · 15,544 sites report using it · SA-CONTRIB-2026-336 · on drupal.org · Week of 11 November 2026

The module does not properly clean the data users enter into their profiles. Someone with an ordinary account could add harmful template code to their profile which runs when their name is shown. They could uncover hidden data but could not change anything else on the site.

Who could do thisOnly someone with a login on your site.
Does it apply to youA site is affected if it is set up to use a name pattern that includes user supplied data and the attacker can edit that data on their own account.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Real Name to 2.0.1.

For developers: what the fix changed

The fix introduces a PatternRenderer service in src/PatternRenderer.php that compiles the real name pattern into a Twig template and passes user token values as context variables, preventing user input from being evaluated as Twig code. This replaces the direct token replacement and Twig rendering in the realname_update function of realname.module.

Also in this release The release also fixes a PHP deprecation warning for an implicitly nullable parameter and adds automated tests.

2.0.0 to 2.0.1 3 commits, 12 files including 6 tests.

realname.api.php +3 −0
realname.install +7 −0 fix
realname.module +9 −13 fix
realname.services.yml +8 −0 fix
src/PatternRenderer.php +192 −0 fix
src/Plugin/Action/RealnameUpdateRealname.php +1 −1

Full diff, 2.0.0 to 2.0.1

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK membership bodies, charities and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Real Name

Real Name

Send me your Drupal site's address.

Get in touch

Links

Reference