Loading vulnerability…
Object Injection and Remote Code Execution in Drupal AlternativeCommerce (Basket)
CVE-2026-9726 affects Drupal AlternativeCommerce (Basket) versions 0.0.0 through 2.1.17, inclusive. Improper control over modification of dynamically determined object attributes permits object injection and can lead to remote code execution. Exploitation is network-accessible, requires no authentication or user interaction, and has low attack complexity. The vulnerability has a reported CVSS score of 9.8. The affected function and precise exploitation mechanism are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can exploit object injection to execute arbitrary code on an affected installation, potentially compromising application data and operations. The execution privilege level and extent of access beyond the application are not specified.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling the AlternativeCommerce (Basket) module where feasible, restricting access to interfaces or workflows that accept attacker-controlled input into the affected functionality, and applying compensating controls such as strict access control, request filtering, and enhanced monitoring for anomalous application behavior. Because the precise vulnerable code path is not available, mitigation guidance is necessarily limited until more specific technical details are published.
Patch, then assume compromise.
Apply the vendor security update for Drupal AlternativeCommerce (Basket) after testing. Upgrade to a vendor-confirmed fixed release newer than 2.1.17 when available; the exact fixed version is not specified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.