{"id":"CVE-2026-108099","aliases":["DRUPAL-CONTRIB-2026-218","EUVD-2026-113553","GHSA-9xvr-v24x-c9rf"],"status":"published","title":"Entity  List - Critical - Remote code execution - SA-CONTRIB-2026-218","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity  List allows Reflection Injection. This issue affects Entity  List versions: from 0.0.0 to 3.0.10.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00411,"percentile":0.35901,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-470"],"published":"2026-10-14T17:26:14Z","modified":"2026-11-06T16:00:50Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/entity_list","fixed_in":["3.0.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/entity_list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10"}]}]}],"products":[{"vendor":"drupal","product":"entity  list"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-218","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108099","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9xvr-v24x-c9rf"},{"url":"https://git.drupalcode.org/project/entity_list","tags":["web"]},{"url":"https://www.drupal.org/project/entity_list","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108099.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-108099","title":"Entity  List - Critical - Remote code execution - SA-CONTRIB-2026-218","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity  List allows Reflection Injection. This issue affects Entity  List versions: from 0.0.0 to 3.0.10.","status":"published","published":"2026-10-30T03:09:50.302Z","modified":"2026-11-06T16:00:50.672Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-470"],"updated_at":"2026-11-06T17:28:52.192546Z"}],"euvd":[{"id":"EUVD-2026-113553","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity  List allows Reflection Injection. This issue affects Entity  List versions: from 0.0.0 to 3.0.10.","status":"published","published":"2026-10-30T03:09:50Z","modified":"2026-11-06T16:00:50Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T17:05:29.708432Z"}],"ghsa":[{"id":"GHSA-9xvr-v24x-c9rf","title":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability...","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity  List allows Reflection Injection. This issue affects Entity  List versions: from 0.0.0 to 3.0.10.","status":"published","published":"2026-10-30T06:31:51Z","modified":"2026-11-06T18:34:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-06T19:01:26.771329Z"}],"nvd":[{"id":"CVE-2026-108099","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity  List allows Reflection Injection. This issue affects Entity  List versions: from 0.0.0 to 3.0.10.","status":"published","published":"2026-10-30T04:18:04.26Z","modified":"2026-11-06T16:17:36.363Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-470"],"updated_at":"2026-11-06T18:00:55.191747Z"}],"osv":[{"id":"CVE-2026-108099","title":"Entity  List - Critical - Remote code execution - SA-CONTRIB-2026-218","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity  List allows Reflection Injection. This issue affects Entity  List versions: from 0.0.0 to 3.0.10.","status":"published","published":"2026-10-30T03:09:50.302Z","modified":"2026-11-08T02:30:49.066735594Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-07T03:08:00.155606Z"},{"id":"DRUPAL-CONTRIB-2026-218","description":"The Entity List module provides a way to create lists of entities without Views.\n\nThe module has a remote code execution vulnerability.\n\nThe vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.","status":"published","published":"2026-10-14T17:26:14Z","modified":"2026-10-14T18:00:02.946186491Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}