CVE-2026-96376 - Vulnerability Details - OpenCVE

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Drupal	Cloud

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-177

History

Fri, 23 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 22 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N'}`

Thu, 22 Oct 2026 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal cloud
Vendors & Products		Drupal Drupal cloud

Thu, 22 Oct 2026 01:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.
Title		Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
Weaknesses		CWE-78
References		https://www.drupal.org/sa-contrib-2026-177

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-22T01:21:29.328Z

Updated: 2026-10-23T03:55:22.710Z

Reserved: 2026-09-23T01:32:48.996Z

Link: CVE-2026-96376

Vulnrichment

Updated: 2026-10-22T14:35:47.895Z

NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:07.947

Modified: 2026-10-23T04:18:24.073

Link: CVE-2026-96376

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96376", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-09-23T01:32:48.996Z", "datePublished": "2026-10-22T01:21:29.328Z", "dateUpdated": "2026-10-23T03:55:22.710Z"}, "containers": {"cna": {"title": "Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177", "datePublic": "2026-09-23T16:51:09.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-177"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\")", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/cloud", "product": "Cloud", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/cloud", "versions": [{"lessThan": "7.0.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1."}], "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "AI Yas (ai_yas)"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "Yas Naoi (yas)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:21:29.328Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-96376"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T03:55:22.710Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-96376", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-22T14:36:31.878741Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T14:35:47.895Z"}}], "cna": {"title": "Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177", "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "AI Yas (ai_yas)"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "Yas Naoi (yas)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/cloud", "vendor": "Drupal", "product": "Cloud", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "7.0.1", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/cloud"}], "datePublic": "2026-09-23T16:51:09.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-177"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:21:29.328Z"}}}, "cveMetadata": {"cveId": "CVE-2026-96376", "state": "PUBLISHED", "dateUpdated": "2026-10-23T03:55:22.710Z", "dateReserved": "2026-09-23T01:32:48.996Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-10-22T01:21:29.328Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}