CVE-2017-6920
Drupal PECL YAML parser unsafe object handling
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
- Record
CVE-2017-6920- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-19
- Updated
- 2026-11-02
CVE List No score
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
- Record
CVE-2017-6920- Updated
- 2026-11-02
EUVDEUVD-2022-3347 No score
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
- Record
EUVD-2022-3347- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9c24-g32g-35rj
Drupal PECL YAML parser unsafe object handling
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
- Record
GHSA-9c24-g32g-35rj- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
- Record
CVE-2017-6920- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-9c24-g32g-35rj
Drupal PECL YAML parser unsafe object handling
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
- Record
GHSA-9c24-g32g-35rj- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
8.0 up to 8.3.4 | 8.3.4 |
drupal/drupalPackagist |
8.0 up to 8.3.4 | 8.3.4 |
drupal/corePackagist |
8.0 up to 8.3.4, plus listed versions 8.0.08.0.0-beta108.0.0-beta118.0.0-beta128.0.0-beta13 Show 45 moreShow less8.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta68.0.0-beta78.0.0-beta88.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.8 |
8.3.4 |
drupal/drupalPackagist |
8.0 up to 8.3.4, plus listed versions 8.0.08.0.0-alpha148.0.0-alpha158.0.0-beta18.0.0-beta10 Show 45 moreShow less8.0.0-beta118.0.0-beta128.0.0-beta138.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta28.0.0-beta38.0.0-beta48.0.0-beta58.0.0-beta68.0.0-beta78.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.2 |
8.3.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6920 is a critical vulnerability (CVSS 9.8) in Drupal, published August 6, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 20.2%, the 97th percentile. Fixed in drupal/core 8.3.4.
References
drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
securityfocus.com/bid/99211
securitytracker.com/id/1038781
nvd.nist.gov/vuln/detail/CVE-2017-6920
github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6920.yaml
Left out here: 22 versions. The JSON record has them.