AIKIDO-2026-543762

TL;DR

SA-CORE-2019-003 blocked direct web-service writes to serialized fields, but a JSON:API gap remained: an attacker with JSON:API write permission could potentially trigger PHP Object Injection by writing to an entity reference field that stores a serialized property. This is low-risk in practice — no Drupal core field type fits the vulnerable pattern, such field types are rare even in contributed/custom code, and JSON:API write access is off by default (it must be explicitly enabled via config or a module) — but this update protects all such fields regardless, with no changes needed in contributed modules.