Live › vulnerability › CVE-2026-118562
Drupal's Single Content Sync module deserializes untrusted data, which allows object injection. The sources do not state what an attacker gets beyond that, so the worst case is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Single Content Sync module at version 1.4.19 or earlier are listed as affected. The sources do not say which configuration or role is needed to reach the vulnerable code, so sites that do not use the module can likely skip it.
No product ranges from the sources yet.
drupal/single_content_sync module with composer show drupal/single_content_sync on the Drupal site.1.4.19 are listed as affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
This page as .md · .json · in your agent: get_signal("CVE-2026-118562")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.