On PostgreSQL-backed Drupal sites, the case-insensitive entity query array condition concatenated the caller-supplied operator straight into a raw SQL fragment without validating it. Code that passes untrusted input as the operator argument (reachable via contrib modules) could inject arbitrary SQL. The fix restricts the operator to IN and NOT IN and throws an InvalidArgumentException for anything else.
This vulnerability affects the following application versions:
- Drupal 11.2.0
- Drupal 11.2.1
- Drupal 11.2.2
- Drupal 11.2.3
- Drupal 11.2.4
- Drupal 11.2.5
- Drupal 11.2.6
- Drupal 11.2.7
- Drupal 11.2.8
- Drupal 11.2.9
- Drupal 11.2.10
- Drupal 11.2.11
- Drupal 11.2.12
- Drupal 11.2.13
- Drupal 11.2.14
- Drupal 11.3.0
- Drupal 11.3.1
- Drupal 11.3.2
- Drupal 11.3.3
- Drupal 11.3.4
- Drupal 11.3.5
- Drupal 11.3.6
- Drupal 11.3.7
- Drupal 11.3.8
- Drupal 11.3.9
- Drupal 11.3.10
- Drupal 11.3.11
- Drupal 11.3.12
- Drupal 11.3.13
- Drupal 11.3.14
- Drupal 11.3.15
- Drupal 11.3.16
- Drupal 11.3.17
- Drupal 11.3.18
- Drupal 11.3.19
- Drupal 11.3.20
- Drupal 11.4.0
- Drupal 11.4.1