Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Drupal ECA Helper can enable remote code execution

CVE-2026-107250 · published 6 days ago
Summary

The Drupal ECA Helper add‑on for websites built with Drupal can be tricked into running any code an attacker provides. This could let a bad actor take control of the site, view or change data, and use the server for other malicious purposes. Apply the latest update for the add‑on or remove it until a safe version is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Packagist:https://packages.drupal.org/8 drupal drupal/eca_helper All versions
– drupal eca helper *.*
Original advisory text
ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193
Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published30 Oct 2026
Updated1 Nov 2026
First seen7 Oct 2026
Sources
DRUPAL-CONTRIB-2026-193 · OSV
CVE-2026-107250 · NVD
CVE-2026-107250 · MITRE
Track software like this
Free during beta