| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/drupal | ≥ 7.0, < 7.60≥ 8.0.0, < 8.5.8≥ 8.6.0, < 8.6.2 | 7.608.5.88.6.2 |
In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail(), which could lead to remote code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free