CVE-2026-9726

CriticalCVSS 9.8

Published: 10/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal AlternativeCommerce (Basket) allows object injection. This affects versions from 0.0.0 to 2.1.17.

Risk Assessment

An attacker can remotely inject a malicious object, potentially leading to arbitrary code execution or system compromise.

Recommendation

Immediately update the AlternativeCommerce (Basket) module to version 2.1.18 or later, which includes the fix.

Original NVD description (English source)

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.