Critical · published May 21, 2026
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 96.9th percentile for exploit probability.
🚨 A sneaky SQL injection vulnerability lurks in multiple versions of Drupal core, making it alarmingly easy for attackers to manipulate your database! 🔥 Imagine a restaurant where customers can write their own orders on the menu without the chef checking the ingredients. This SQL injection flaw allows an attacker to issue commands directly to the database, crafting malicious queries that can wreak havoc with your data. An attacker can gain unauthorized access, read sensitive data, modify records, or even delete your entire database! This could lead to devastating data breaches, loss of customer trust, and significant operational disruptions—absolutely catastrophic for any organization!
Imagine a restaurant where customers can write their own orders on the menu without the chef checking the ingredients. This SQL injection flaw allows an attacker to issue commands directly to the database, crafting malicious queries that can wreak havoc with your data. This vulnerability in Drupal core allows attackers to exploit improper handling of special elements in SQL commands, leading to SQL injection attacks. Affected versions include 8.9.0 prior to 10.4.10, and various branches before their respective patched releases.
An attacker can gain unauthorized access, read sensitive data, modify records, or even delete your entire database! This could lead to devastating data breaches, loss of customer trust, and significant operational disruptions—absolutely catastrophic for any organization! Update your Drupal core immediately to the latest versions: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10. Additionally, review all SQL queries to ensure proper parameterization and validation to prevent further vulnerabilities. You've got this! Follow these steps, patch up, and you'll have your site fortified in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| drupal/drupal | ≥ 8.9.0, < 10.4.10 | 10.4.10 |
| drupal/drupal | ≥ 10.5.0, < 10.5.10 | 10.5.10 |
| drupal/drupal | ≥ 10.6.0, < 10.6.9 | 10.6.9 |
| drupal/drupal | ≥ 11.0.0, < 11.1.10 | 11.1.10 |
| drupal/drupal | ≥ 11.2.0, < 11.2.12 | 11.2.12 |
| drupal/drupal | ≥ 11.3.0, < 11.3.10 | 11.3.10 |