~ / search / GHSA-ghwc-95x2-682j

GHSA-ghwc-95x2-682j

Drupal Core has a SQL Injection issue

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-9082

Packages

EcosystemPackageAffectedFixed in
Packagist drupal/core >= 8.9.0, < 10.4.10 10.4.10
Packagist drupal/core >= 10.5.0, < 10.5.10 10.5.10
Packagist drupal/core >= 10.6.0, < 10.6.9 10.6.9
Packagist drupal/core >= 11.0.0, < 11.1.10 11.1.10
Packagist drupal/core >= 11.2.0, < 11.2.12 11.2.12
Packagist drupal/core >= 11.3.0, < 11.3.10 11.3.10

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

References

External links from the advisory. They lead to third-party sites.