Use of externally controlled input to select classes or code creates an unsafe reflection flaw that can lead to code injection; attackers who can influence the input can cause the system to instantiate arbitrary classes and execute arbitrary code. The vulnerability is reported as a remote code execution flaw and is directly tied to the Entity List module’s handling of class names. This deficiency is a classic example of CWE‑470, where unsafe reflection is used in a web application context.

Drupal’s Entity List module is affected, specifically any release from version 0.0.0 through 3.0.10. The issue resides in the way the module processes external input when determining which entity class to instantiate, making all deployments using these versions susceptible.

The CVSS base score is not disclosed, yet the precise impact is remote code execution, implying very high severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalogue, so while no quantitative exploit probability can be provided, the lack of mitigations in the affected releases suggests that an attacker could exploit this flaw if the vulnerable endpoint is exposed. The likely attack vector involves sending crafted input to an API or form that feeds the Entity List component, thus allowing an attacker to inject arbitrary class names and trigger execution. Because the flaw relies on untrusted input, environments that permit wide access to the affected module are at greatest risk.