Improper neutralization of special elements in SQL commands in Drupal core permits an attacker to inject arbitrary SQL statements, potentially allowing unauthorized read, modify or delete operations on the database. This flaw is a classic CWE-89 vulnerability that directly compromises confidentiality, integrity and availability of data processed by the application.

Drupal core versions from 8.9.0 up to, but not including, 10.4.10; 10.5.0 up to, but not including, 10.5.10; 10.6.0 up to, but not including, 10.6.9; 11.0.0 up to, but not including, 11.1.10; 11.2.0 up to, but not including, 11.2.12; and 11.3.0 up to, but not including, 11.3.10 are affected.

The CVSS score of 9.8 denotes critical severity, while an EPSS of 85% indicates a high probability that the vulnerability will be exploited in the wild. The vulnerability is listed in CISA KEV, underscoring its real‑world risk. Based on the description, the likely attack vector is remote via web input, and exploitation would involve submitting crafted data that is directly incorporated into database queries without proper sanitization.