GHSA-jjx7-8462-w4m4: Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution

The vulnerability stems from improper input validation in contextual links processing. The ContextualController::renderLinks method handles user-submitted serialized data (via 'ids' parameter) to generate contextual links. The advisory indicates insufficient validation of these contextual links requests, which aligns with deserialization vulnerabilities (CWE-20). Drupal's patch would have addressed this by adding validation/sanitization before deserialization. The method's role in processing untrusted input and the RCE outcome strongly suggest this as the vulnerable entry point.