This vulnerability (CWE-915) in Drupal's ECA: Event - Condition - Action module involves improper control over modification of dynamically-determined object attributes, which can result in object injection attacks. Affected versions include 0.0.0, 3.0.0, and 3.1.0 series up to 2.1.20, 3.0.12, and 3.1.4 respectively. The vulnerability is publicly disclosed but lacks a CVSS score and official remediation details. The module is not a cloud service, so remediation depends on patching by site administrators.

Successful exploitation could allow an attacker to perform object injection, potentially leading to unauthorized code execution or manipulation of application behavior. However, no known exploits have been reported in the wild, and the exact impact depends on the deployment context and usage of the vulnerable module versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable module versions and monitor for updates from Drupal regarding patches or mitigations.