Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. (CVE-2026-96376)

CVE-2026-96376 describes an OS Command Injection vulnerability in Drupal Cloud where special elements used in OS commands are not properly neutralized. This flaw affects versions from 0.0.0 through 7.0.1. Exploitation requires network access, a high attack complexity, low privileges, and user interaction. Successful exploitation can result in high impact on confidentiality and integrity, but does not affect availability. No known exploits are reported in the wild, and no patch or remediation information is provided in the available data.

An attacker who successfully exploits this vulnerability can execute arbitrary OS commands on the affected Drupal Cloud system, potentially leading to unauthorized disclosure and modification of sensitive data. The vulnerability does not impact system availability. The attack requires user interaction and low privileges, with a high complexity of attack, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, limit exposure by restricting access to the affected versions and applying any recommended configuration changes from the vendor.