View online: https://www.drupal.org/sa-contrib-2026-218 Project: Entity List [1] Project machine name: entity_list Date: 2026-October-14 Security risk: *Critical* 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote code execution Affected versions: <3.0.10 CVE IDs: CVE-2026-108099 Description: The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. Solution: Install the latest version: * Upgrade to Entity List 3.0.10 [3]. Reported By: * Lee Rowlands (larowlan) [4] of the Drupal Security Team * Dave Long (longwave) [5] of the Drupal Security Team * Drew Webber (mcdruid) [6] of the Drupal Security Team * Octavio Galland (ogalland-tob) [7] Fixed By: * catch (catch) [8] of the Drupal Security Team * Lee Rowlands (larowlan) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team * Marc-Antoine MARTY (martygraphie) [11] * Drew Webber (mcdruid) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [14] of the Drupal Security Team * Bram Driesen (bramdriesen) [15] of the Drupal Security Team * catch (catch) [16] of the Drupal Security Team * Damien McKenna [17] of the Drupal Security Team * Greg Knaddison (greggles) [18] of the Drupal Security Team * Tim Hestenes Lehnen (hestenet) [19] * Lee Rowlands (larowlan) [20] of the Drupal Security Team * Dave Long (longwave) [21] of the Drupal Security Team * Drew Webber (mcdruid) [22] of the Drupal Security Team * Juraj Nemec (poker10) [23] of the Drupal Security Team * Pierre Rudloff (prudloff) [24] of the Drupal Security Team * Jess (xjm) [25] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [26] [1] https://www.drupal.org/project/entity_list [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/entity_list/releases/3.0.10 [4] https://www.drupal.org/u/larowlan [5] https://www.drupal.org/u/longwave [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/ogalland-tob [8] https://www.drupal.org/u/catch [9] https://www.drupal.org/u/larowlan [10] https://www.drupal.org/u/longwave [11] https://www.drupal.org/u/martygraphie [12] https://www.drupal.org/u/mcdruid [13] https://www.drupal.org/u/xjm [14] https://www.drupal.org/u/akalata [15] https://www.drupal.org/u/bramdriesen [16] https://www.drupal.org/u/catch [17] https://www.drupal.org/u/damienmckenna [18] https://www.drupal.org/u/greggles [19] https://www.drupal.org/u/hestenet [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/u/longwave [22] https://www.drupal.org/u/mcdruid [23] https://www.drupal.org/u/poker10 [24] https://www.drupal.org/u/prudloff [25] https://www.drupal.org/u/xjm [26] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....