DRUPAL-CORE-2026-014: Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Published Oct 30, 2026
·Updated
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionWeakness
Frequently Asked Questions
1
Which Drupal core installations fall within the affected version ranges?
Affected versions are 8.9.0 through 10.6.19, 11.0.0 through 11.3.19, 11.4.0 through 11.4.10, and 12.0.0-alpha1 through 12.0.0-beta2.
2
What vulnerability class is involved?
The issue is an unsafe reflection vulnerability: externally controlled input can be used to select classes or code, resulting in reflection injection.