{"id":"CVE-2026-96378","kind":"vulnerability","aliases":["CVE-2026-96378"],"related":[],"title":"Drupal Commerce Decoupled Checkout: object injection flaw in versions 1.0.0 to 1.8.0","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.","summary":"Drupal Commerce Decoupled Checkout, a Drupal module, has an improperly controlled modification of object attributes that allows PHP object injection. The sources do not say what an attacker can do after injecting an object.","severity":"medium","cvss":4.3,"epss":0.00302,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-commerce","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Drupal Commerce Decoupled Checkout module, for example with `drush pm:list --filter=commerce_decoupled_checkout` (module machine name unknown from sources)\n- Look for the module in `composer.lock` under the Drupal Commerce Decoupled Checkout package","fix":"- Move the Drupal Commerce Decoupled Checkout module to a version later than `1.8.0` (the fixed version is not named in the sources)","status":"open","published_at":"2026-10-22T02:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:37:29+00:00","updated_at":"2026-10-25T04:37:29+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:37:29Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Drupal Commerce Decoupled Checkout module to a version later than `1.8.0` (the fixed version is not named in the sources)","reach":"unknown","title":"Drupal Commerce Decoupled Checkout: object injection flaw in versions 1.0.0 to 1.8.0","impact":"medium","summary":"Drupal Commerce Decoupled Checkout, a Drupal module, has an improperly controlled modification of object attributes that allows PHP object injection. The sources do not say what an attacker can do after injecting an object.","category":"package","nicknames":[],"who_cares":["drupal","drupal-commerce","php"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; object injection may allow code execution depending on gadgets","analyst_note":"Find the advisory from the Drupal security team and the fixed version, and confirm the attack prerequisites and worst-case impact.","how_to_check":"- Check the installed version of the Drupal Commerce Decoupled Checkout module, for example with `drush pm:list --filter=commerce_decoupled_checkout` (module machine name unknown from sources)\n- Look for the module in `composer.lock` under the Drupal Commerce Decoupled Checkout package","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running Drupal Commerce Decoupled Checkout from `1.0.0` through `1.8.0`. The sources do not say which configurations or request paths make a site exposed, so the exact exposure is unknown. Sites without this module can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3357,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-96378':15A,18A '1.0.0':10A,85C '1.8.0':12A,87C 'affect':79C 'allow':41B,74C 'attack':52B 'attribut':39B,67C 'checkout':4A,28B,73C,82C 'commerc':2A,22B,26B,71C,80C 'control':35B,60C 'cve':13A,16A 'decoupl':3A,27B,72C,81C 'determin':65C 'drupal':1A,19B,21B,25B,30B,70C 'drupal-commerc':20B 'dynam':64C 'dynamically-determin':63C 'flaw':7A 'improp':34B,59C 'inject':6A,44B,56B,76C 'issu':78C 'modif':36B,61C 'modul':31B 'object':5A,38B,43B,58B,66C,75C 'packag':23B 'php':24B,42B 'say':49B 'sourc':46B 'version':9A,83C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal Commerce Decoupled Checkout from `1.0.0` through `1.8.0`. The sources do not say which configurations or request paths make a site exposed, so the exact exposure is unknown. Sites without this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96378","severity":null,"published_at":"2026-10-22T02:17:08+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96378","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96378","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}