EUVD-2026-43042
GHSA-ggc6-38jq-q957
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated request reaches the injection sink (AV:N/PR:N/UI:N); PHP object injection typically yields code execution, so full C/I/A impact with AC:L absent evidence of a gating gadget requirement.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
AnalysisAI
PHP object injection in the Drupal AlternativeCommerce (Basket) contributed module (all versions up to and including 2.1.17) allows remote unauthenticated attackers to modify dynamically-determined object attributes and inject crafted objects into the application. Successful exploitation can lead to code execution or full compromise of the Drupal site, with CVSS 3.1 scoring it 9.8 (Critical). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable AlternativeCommerce (Basket) contrib module must be installed and enabled on a Drupal site running an affected version (0.0.0 through 2.1.16). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are partially conflicting and warrant nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker sends a crafted HTTP request to a Drupal site running a vulnerable AlternativeCommerce (Basket) module, embedding a malicious serialized PHP object into a parameter the module deserializes or uses to populate object attributes. When the module processes the input, the injected object triggers a property-oriented gadget chain in the loaded PHP code, allowing the attacker to tamper with application state or execute code. … |
| Remediation | Upgrade the AlternativeCommerce (Basket) module to version 2.1.17 or later, which is the vendor-released fixed version per Drupal security advisory SA-CONTRIB-2026-038 (https://www.drupal.org/sa-contrib-2026-038); the input confirms a patch is available from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Drupal installations to identify systems running AlternativeCommerce module versions up to 2.1.17. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today