DRUPAL-CONTRIB-2026-218: Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218
Published Oct 30, 2026
·Updated
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
Affected Software
1 affected component
Drupal Entity List>=0.0.0<=3.0.10
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Entity List installations are affected?
Drupal Entity List versions from 0.0.0 through 3.0.10 are affected.
2
Can this be exploited remotely without authentication or user interaction?
The supplied vector identifies network access, no privileges, and no user interaction as required. Exploitation complexity is rated high.
3
What is the potential impact of successful exploitation?
The issue is described as reflection injection leading to remote code execution. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.