{"id":"CVE-2026-118562","kind":"vulnerability","aliases":["CVE-2026-118562"],"related":[],"title":"Drupal Single Content Sync: untrusted data deserialization allows object injection","description":"Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.","summary":"Drupal's Single Content Sync module deserializes untrusted data, which allows object injection. The sources do not state what an attacker gets beyond that, so the worst case is unknown.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the `drupal/single_content_sync` module with `composer show drupal/single_content_sync` on the Drupal site.\n- Versions up to `1.4.19` are listed as affected.","fix":null,"status":"open","published_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:16+00:00","updated_at":"2026-10-30T04:29:16+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Drupal Single Content Sync: untrusted data deserialization allows object injection","impact":"high","summary":"Drupal's Single Content Sync module deserializes untrusted data, which allows object injection. The sources do not state what an attacker gets beyond that, so the worst case is unknown.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; object injection may allow code execution","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, the required access, and the exploit path.","how_to_check":"- Check the installed version of the `drupal/single_content_sync` module with `composer show drupal/single_content_sync` on the Drupal site.\n- Versions up to `1.4.19` are listed as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Single Content Sync module at version 1.4.19 or earlier are listed as affected. The sources do not say which configuration or role is needed to reach the vulnerable code, so sites that do not use the module can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000654,"input_tokens":4086,"output_tokens":490,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118562':13A,16A '-2026':12A,15A '0.0.0':74C '1.4.19':76C 'affect':68C 'allow':8A,33B,63C 'attack':43B 'beyond':45B 'case':50B 'content':3A,26B,61C,70C 'cve':11A,14A 'data':6A,31B,56C 'deseri':7A,29B,53C 'drupal':1A,17B,23B,59C 'get':44B 'host':22B 'inject':10A,35B,65C 'issu':67C 'modul':28B 'object':9A,34B,64C 'packag':18B 'php':19B 'self':21B 'self-host':20B 'singl':2A,25B,60C,69C 'sourc':37B 'state':40B 'sync':4A,27B,62C,71C 'unknown':52B 'untrust':5A,30B,55C 'version':72C 'vulner':57C 'worst':49B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Single Content Sync module at version 1.4.19 or earlier are listed as affected. The sources do not say which configuration or role is needed to reach the vulnerable code, so sites that do not use the module can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118562","severity":null,"published_at":"2026-10-30T04:18:21+00:00","modified_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}