3 ms·Drupal fixes highly critical flaw, but offers no details26 points by mediawatch 9y agotyingq 9y agoAh wow, that is really bad. RCE via multiple vectors (http post, cookies, url params) just by using a leading '#' char.