CVE-2017-6920

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 20.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-06 · updated 2026-06-17
Weakness: CWE-19

Description

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.

Affected products

Drupal: from 8.0.0 before 8.3.4 — fixed in 8.3.4

How to fix

Upgrade to a fixed version: Drupal 8.3.4. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/99211
http://www.securitytracker.com/id/1038781
https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
http://www.securityfocus.com/bid/99211
http://www.securitytracker.com/id/1038781
https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple

Get alerted when CVE-2017-6920 or the next vulnerability affects your stack