{"id":"CVE-2017-6920","aliases":["GHSA-9c24-g32g-35rj"],"url":"https://o3.security/vulnerability/CVE-2017-6920","summary":"Drupal PECL YAML parser unsafe object handling","details":"Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.","published":"2018-08-06T15:29:00.237Z","modified":"2026-07-08T11:36:08.269806Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"drupal/core","fixedVersion":"8.3.4"},{"ecosystem":"Packagist","name":"drupal/drupal","fixedVersion":"8.3.4"}],"fix":null,"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/99211"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1038781"},{"type":"FIX","url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6920"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6920.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6920.yaml"},{"type":"PACKAGE","url":"https://github.com/drupal/core"},{"type":"WEB","url":"https://www.drupal.org/SA-CORE-2017-003"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T11:36:08.269806Z"}}