David Strauss

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.