Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | Entity List | 0.0.0 – < 3.0.10 | 3.0.10 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/entity_list | < 3.0.10 | 3.0.10 | DRUPAL-CONTRIB-2026-218 |
Advisories 2
- WID-SEC-2026-3968 Drupal Core, Gin Admin Theme und Entity List: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2026
- NCSC-2026-0438 Kwetsbaarheden verholpen in Drupal Core en modules door Drupal NCSC-NL (Netherlands) · Oct 19, 2026