CVE-2026-9726 Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
An attacker can execute arbitrary PHP code via object injection in the Drupal AlternativeCommerce plugin, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9726?
CVE-2026-9726 is a critical unsafe deserialization vulnerability in Drupal AlternativeCommerce (Basket), published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
Weakness: CWE-915
Which versions are affected by CVE-2026-9726?
It affects 1 product.
Linux distribution packages (1)
drupal/basket Packagist:https://packages.drupal.org/8 | All versions | 2.1.17 |
Products include Alternativecommerce Alternativecommerce.
How do I fix CVE-2026-9726?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-9726 being exploited?
There is no known exploitation of CVE-2026-9726 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-038, GHSA-ggc6-38jq-q957.