External risk intelligence

Drupal AlternativeCommerce Basket Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-9726

The vulnerability affects a Drupal commerce module. Drupal is commonly deployed as a public-facing web application or e-commerce storefront, making the underlying modules, including those handling baskets and object attributes, exposed to internet-based traffic in standard deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a Drupal module used for e-commerce, specifically related to how it handles product attributes within the shopping basket. This issue could allow for unauthorized modification of objects, potentially impacting the integrity and availability of data within the affected system. The main concern is confirming whether this specific module is in use and, if so, understanding the potential exposure.

Module allows unauthorized object modification.
Affects e-commerce platforms using Drupal.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to a Drupal AlternativeCommerce (Basket) instance. This could lead to the injection of malicious objects into the application, potentially allowing the attacker to gain control over the system.

No authentication required.
Triggers via network requests.
Allows object injection and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in a Drupal commerce module could allow an attacker to inject objects into the system, potentially leading to unauthorized modification of data or services when supported by the advisory.

System data and service behavior.
Remote unauthenticated object injection.
Compromised system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Drupal AlternativeCommerce (Basket) module, likely deployed as part of public-facing e-commerce websites. Responsibility for addressing this typically falls to the application owners and platform teams managing the Drupal instances, with support from network and security teams for exposure analysis. The immediate first step is to inventory all instances of the affected module, confirm their accessibility and business criticality, and then prioritize remediation based on this risk assessment.

Application owners are responsible.
Verify module reachability and criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Drupal AlternativeCommerce (Basket) module?

It is a contributed extension for the Drupal content management system designed to handle e-commerce functionality. Specifically, it manages the shopping basket and product attributes for online storefronts, allowing site administrators to process customer selections and cart data within the Drupal framework.

What does Object Injection mean for CVE-2026-9726?

This vulnerability, classified as CWE-915, involves the improper control of dynamically determined object attributes. In plain terms, the software fails to properly sanitize input, allowing an attacker to supply data that tricks the application into modifying its internal object structures. This can force the system to perform unintended actions or alter data states, potentially leading to a complete compromise of the application's integrity.

How is this Drupal vulnerability triggered?

An attacker triggers this issue by sending a specially crafted network request to the Drupal instance. Because the vulnerability exists within the logic that processes shopping basket attributes, it does not require the attacker to have an existing user account or administrative privileges to interact with the system. Simply accessing the affected web component via the network is sufficient to initiate the malicious injection.

Is my site at risk if it uses this module?

According to Halo Surface Signal, this module is commonly deployed as part of public-facing e-commerce storefronts, which increases the likelihood of exposure to internet-based traffic. If your Drupal instance is accessible via the public internet, it faces a higher risk because the vulnerability is reachable remotely without authentication. Internal-only sites may have a different risk profile, but all instances using versions 0.0.0 through 2.1.17 should be reviewed.

What steps should I take if I run this software?

Begin by auditing your environment to locate every instance where the Drupal AlternativeCommerce (Basket) module is currently installed. Once you have an accurate inventory, assess whether these instances are reachable from the internet or handle sensitive business data. Prioritize these systems for updates or remediation based on their business criticality and network exposure, while coordinating with your web administration team to manage the underlying Drupal platform.

References

www.drupal.org/sa-contrib-2026-038

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.