—
DRUPAL-CONTRIB-2026-038
Details
The Basket module enables e-commerce and checkout functionality for Drupal sites.
The module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize().
An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8 / drupal/basket
Introduced in:
0 Fixed in: 2.1.17 Upgrade drupal/basket to 2.1.17 or newer (ecosystem packagist:https://packages.drupal.org/8).