–
Not scored
CVE-2026-108099
Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218
Entity List · CWE-470 · CWE-470AffectedEntity List
FixUpdate to 3.0.10 or newer
PublishedOct 30, 03:09 · drupal
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
From drupal
Affected and fixed versions
ProductAffectedFixed inEntity List0.0.0 – before 3.0.103.0.10
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known