{"id":"CVE-2017-6920","details":"Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.","aliases":["GHSA-9c24-g32g-35rj"],"modified":"2026-07-08T11:36:08.269806Z","published":"2018-08-06T15:29:00.237Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/99211"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1038781"},{"type":"FIX","url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/drupal/drupal","events":[{"introduced":"35c2f3ca5c935f3d8bde15932a712677c9bbd50f"},{"fixed":"a795651d0b60a8a5d4867223fbc10bcbdfb5ee87"}],"database_specific":{"cpe":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.0.0"},{"fixed":"8.3.4"}],"source":"CPE_RANGE"}}],"versions":["8.3.3","8.3.2","8.3.0","8.3.0-rc2","8.3.0-rc1","8.3.0-beta1","8.3.0-alpha1","8.1.0-beta1","8.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6920.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}