This vulnerability (CWE-915) in Drupal AlternativeCommerce (Basket) allows attackers to improperly control and modify dynamically-determined object attributes, resulting in object injection. This can lead to full compromise of the affected system due to the high CVSS score (9.8) with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The affected versions range from 0.0.0 to 2.1.17. No vendor advisory or patch is currently available, and no known exploits have been reported.

Successful exploitation can lead to complete compromise of the affected system, including unauthorized disclosure, modification, and disruption of service. The vulnerability allows remote attackers to inject malicious objects, potentially leading to full system control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected component and monitoring for unusual activity related to object injection attempts.