Live › vulnerability › CVE-2026-96378
Go to dashboardDrupal Commerce Decoupled Checkout, a Drupal module, has an improperly controlled modification of object attributes that allows PHP object injection. The sources do not say what an attacker can do after injecting an object.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Drupal Commerce Decoupled Checkout from through . The sources do not say which configurations or request paths make a site exposed, so the exact exposure is unknown. Sites without this module can skip it.
1.0.01.8.0No product ranges from the sources yet.
drush pm:list --filter=commerce_decoupled_checkout (module machine name unknown from sources)composer.lock under the Drupal Commerce Decoupled Checkout package1.8.0 (the fixed version is not named in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-96378")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.