Vulnerability advisory

GHSA-jf8c-36vw-98x4

Drupal core Remote Code Execution

Published May 15, 2024Updated Nov 29, 2024OSV record ↗

Severity

Severity not reported.

Affected versions

drupal/drupal Packagist

Affected	Fixed in
`7.0` to before 7.60	`7.60`Advisories →
`8.0.0` to before 8.5.8	`8.5.8`Advisories →
Also listed as affected (73) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.3.9` `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.4.6` `8.4.7` `8.4.8` `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1` `8.5.1` `8.5.2` `8.5.3` `8.5.4` `8.5.5` `8.5.6` `8.5.7`
`8.6.0` to before 8.6.2	`8.6.2`Advisories →
Also listed as affected (2) `8.6.0` `8.6.1`

Description

In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail(), which could lead to remote code execution.

GHSA-jf8c-36vw-98x4

Affected versions

drupal/drupal Packagist

Description

References