Improperly controlled modification of dynamically‑determined object attributes in Drupal core enables object injection, allowing an attacker to instantiate classes of their choosing. This flaw can be leveraged to execute arbitrary code or gain elevated privileges, representing a high‑severity weakness in the application.

Drupal core is impacted across several version ranges: 8.0.0 through 10.5.8, 10.6.0 through 10.6.6, 11.0.0 through 11.2.10, and 11.3.0 through 11.3.6. All releases prior to the specified patch releases in each major and minor branch are vulnerable.

The vulnerability is remotely exploitable through crafted web requests that supply dynamic class names or attributes. The EPSS score of 0.00023 indicates a very low probability that an attacker will successfully exploit it. The flaw is not listed in CISA KEV, indicating no documented exploitation yet. The CVSS score is 6.6, but the combination of object injection and potential remote code execution suggests a high likelihood of severe impact if discovered or misused. Attacks would typically require the ability to send requests that influence object construction, which may be facilitated by standard user input or custom modules.