Live › vulnerability › CVE-2026-96376
Go to dashboardDrupal Cloud has an OS command injection flaw affecting versions from 0.0.0 through 7.0.1. An attacker who can reach the affected feature could pass input that the server runs as a shell command.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Drupal Cloud at versions up to and including 7.0.1. The sources do not describe which feature or configuration triggers the flaw, so the exposed surface is unknown.
No product ranges from the sources yet.
Unknown from the sources.
7.0.1, once a fixed version is confirmed by the vendorEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96376")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.