AIKIDO-2026-34610
drupal/core is vulnerable to Deserialization of Untrusted Data
65
CVE Score
Medium
Deserialization of Untrusted Data
TL;DR
Drupal core contains a "gadget chain" — a sequence of methods that, while not directly exploitable on its own, could be leveraged for remote code execution or SQL injection if an insecure deserialization vulnerability exists elsewhere in the application. This issue poses no standalone risk, as exploitation requires a separate, independent vulnerability that allows an attacker to pass unsafe input to unserialize().
How do I fix this?
Upgrade the drupal/core library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Package
Versions
0.0.0 - 10.5.11
Fixed in 10.5.1210.6.0 - 10.6.10
Fixed in 10.6.1111.0.0 - 11.2.13
Fixed in 11.2.1411.3.0 - 11.3.11
Fixed in 11.3.12Background info
drupal/core is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 10.5.11, 10.6.0 - 10.6.10, 11.0.0 - 11.2.13 and 11.3.0 - 11.3.11.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.