1name: crowdsecurity/vpatch-CVE-2026-9082
2description: 'Detects SQL injection in Drupal JSON:API filter parameter keys (CVE-2026-9082).'
3rules:
4  - and:
5      - zones:
6          - URI
7        transform:
8          - urldecode
9          - lowercase
10        match:
11          type: contains
12          value: '/jsonapi/'
13      - or:
14        - zones:
15            - ARGS_NAMES
16          transform:
17            - urldecode
18            - lowercase
19          match:
20            type: contains
21            value: '||'
22        - zones:
23            - ARGS_NAMES
24          transform:
25            - urldecode
26            - lowercase
27          match:
28            type: contains
29            value: '`'
30labels:
31  type: exploit
32  service: http
33  confidence: 3
34  spoofable: 0
35  behavior: 'http:exploit'
36  label: 'Drupal - SQLI'
37  classification:
38    - cve.CVE-2026-9082
39    - attack.T1190
40    - cwe.CWE-89