Packagist/drupal/core CVE-2019-6340: unknown, exploited, EPSS 92.02%

Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.

Action: Upgrade drupal/core to 8.5.11 or later.

composer require drupal/core:8.5.11

composer require drupal/core:8.6.10

Affected

Fixed versions

Sources

• osv: DRUPAL-CORE-2019-003
• kev: CVE-2019-6340
• https://www.drupal.org/sa-core-2019-003

CVE-2019-6340 · published 2019-02-20T19:18:48Z · modified 2026-09-19T19:59:43Z · JSON