CVE-2026-108099

Name of the Vulnerable Software and Affected Versions Entity List versions 0.0.0 through 3.0.10

Description An Unsafe Reflection issue exists where externally-controlled input can be used to select classes or code, leading to Reflection Injection. This flaw allows for remote code execution. While the issue is not directly exploitable using the module in isolation, multiple serious exploit paths exist when combined with other contributed modules, including at least one path that does not require authentication. Custom code may also expose this functionality.

Recommendations Update Entity List to a version later than 3.0.10.