Project: 
JSON:API
Date: 
2019-February-20
Security risk: 
Highly critical 25 ∕ 25 AC:None/A:None/CI:All/II:All/E:Exploit/TD:All
Vulnerability: 
Remote code execution
Affected versions: 
<1.25.0 || >=2.0.0 >2.3.0
Description: 

This resolves issues described in SA-CORE-2019-003 for this module.

Solution: 

Install the latest version:

  • If you use the 2.x version of the JSON:API module for Drupal 8.x, upgrade to JSON:API 8.x-2.3
  • If you use the 1.x version of the JSON:API module for Drupal 8.x, upgrade to JSON:API 8.x-1.25