{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-9726","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-9726\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-9726\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3190361","id":"3190361","resource":"node"},"field_sa_advisory_id":"038","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/longwave\u0022 rel=\u0022nofollow\u0022\u003EDave Long (longwave)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mcdruid\u0022 rel=\u0022nofollow\u0022\u003EDrew Webber (mcdruid)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:None\/A:None\/CI:All\/II:All\/E:Theoretical\/TD:All","field_sa_description":{"value":"\u003Cp\u003EThe Basket module enables e-commerce and checkout functionality for Drupal sites.\u003C\/p\u003E\n\u003Cp\u003EThe module does not sufficiently sanitize user-supplied data before passing it to PHP\u0027s unserialize().\u003C\/p\u003E\n\u003Cp\u003EAn attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/helena-zajika\u0022 rel=\u0022nofollow\u0022\u003EHelena Zajika (helena zajika)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mcdruid\u0022 rel=\u0022nofollow\u0022\u003EDrew Webber (mcdruid)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/mcdruid\u0022 rel=\u0022nofollow\u0022\u003EDrew Webber (mcdruid)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the Basket module, upgrade to Basket 2.1.17.\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Arbitrary PHP code execution","field_issue_last_status_change":"1779906738","field_sa_cve":["CVE-2026-9726"],"field_is_psa":"0","field_affected_versions":"\u003C2.1.17","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3592074","id":"3592074","resource":"node"}],"nid":"3591593","vid":"14363158","is_new":false,"type":"sa","title":"Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-038","edit_url":"https:\/\/www.drupal.org\/node\/3591593\/edit","status":"1","promote":"0","sticky":"0","created":"1779906738","changed":"1779906738","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16599787","id":16599787,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16599788","id":16599788,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16599789","id":16599789,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16599910","id":16599910,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1779906738"}]}