drupal/core · Security
Drupal core Remote Code Execution
- GHSA ID
- GHSA-6mgp-v5cm-ghg5
- Severity
- critical
- Published
- Updated
Description
In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail(), which could lead to remote code execution.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')