DRUPAL-CONTRIB-2026-277: Composer/drupal/commerce_payumoney vulnerability

Published Oct 28, 2026

Updated

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Affected Software

1 affected component

composer/drupal/commerce_payumoney*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Maintain the project only by following the Drupal documentation for becoming the primary maintainer of a project that is unsupported for security reasons.

Event History

Oct 28, 2026

Advisory Published

via OSV·05:18 PM

Data Sourced

via OSV·05:18 PM

DescriptionAffected Software

Frequently Asked Questions

What should teams using this package do?

Treat the project as unsupported and plan to remove or replace it. The known security issue has not been fixed by the maintainer.

Is there a patched version available?

No patched version is identified in the provided advisory data. The project is being marked unsupported because the known issue remains unresolved.

How can we confirm whether we are affected?

Check whether your application depends on composer/drupal/commerce_payumoney. Any deployment using this unsupported project should be reviewed because the advisory does not identify a fixed release.

DRUPAL-CONTRIB-2026-277: Composer/drupal/commerce_payumoney vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What should teams using this package do?

Is there a patched version available?

How can we confirm whether we are affected?

Company

Resources

Contact

Frequently Asked Questions

What should teams using this package do?

Is there a patched version available?

How can we confirm whether we are affected?