DRUPAL-CORE-2026-002 in drupal/core
Published 15 Apr 2026 · Updated 10 Sept 2026
Affected package
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
composer require drupal/core:^11.3.7Details
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.
This issue is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.
Is DRUPAL-CORE-2026-002 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.