The vulnerability in the Tealium iQ Tag Management module involves improper control over the attributes of dynamically determined objects. This flaw enables an attacker to inject a crafted PHP object, potentially causing unintended method calls or property assignments that lead to remote code execution. The weakness is classified as CWE‑915, reflecting improper handling of object attributes that can be manipulated by external input.

Affected systems are Drupal installations that include the Tealium iQ Tag Management module, specifically versions ranging from 0.0.0 through 2.4.0. Any site employing these module versions is potentially vulnerable.

The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. The CVSS score likely attack vector is crafted input that influences object instantiation, likely via serialized data or form fields that the module processes. Exploitation requires that input to trigger improper handling of object attributes, enabling injection of a PHP object that can lead to remote code execution. Despite the low EPSS, administrators should treat the risk as significant and apply the fix promptly.