DRUPAL-CONTRIB-2026-074unknown
DRUPAL-CONTRIB-2026-074
The advisory, in context
The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models.
The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure.
This vulnerability is mitigated by the fact that a site must be running an ECA model that uses the "Render: Twig" action on a data flow.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/eca Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 2.1.20
Fixed in 2.1.20
Ecosystem versions
From 3.0.0 before 3.0.12
Fixed in 3.0.12
Ecosystem versions
From 3.1.0 before 3.1.4
Fixed in 3.1.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.20"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<2.1.20"
}
},
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.12"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=3.0.0 <3.0.12"
}
},
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.4"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=3.1.0 <3.1.4"
}
}
],
"versions": []
}