CVE-2017-6920

CVE-2017-6920 is a critical remote code execution vulnerability affecting Drupal core versions prior to 8.3.4, stemming from the PECL YAML parser's unsafe handling of PHP objects. With a CVSS score of 9.8, it presents a low-complexity attack vector that requires no user interaction, allowing unauthenticated attackers to achieve full compromise of confidentiality, integrity, and availability. While no public exploit code or Metasploit modules are available, the vulnerability has garnered significant community discussion and media coverage, including reports of its exploitation in spam campaigns.