View online: https://www.drupal.org/sa-contrib-2019-019

Project: JSON:API [1] Date: 2019-February-20 Security risk: *Highly critical* 22∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote code execution

Description:  This resolves issues described in SA-CORE-2019-003 [3] for this module.

Solution:  Install the latest version:

* If you use the *2.x* version of the JSON:API module for Drupal 8.x, upgrade to JSON:API 8.x-2.3 [4] * If you use the *1.x* version of the JSON:API module for Drupal 8.x, upgrade to JSON:API 8.x-1.25 [5]

[1] https://www.drupal.org/project/jsonapi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/node/3034433 [5] https://www.drupal.org/node/3034431