Code execution via database transaction gadget chain

Object injection in Drupal core allows attackers to execute code through a crafted serialized database transaction object chain. Deserialization can populate Transaction internals so a post-transaction callback reaches a service definition whose factory invokes an attacker-selected function. Exploitation requires another flaw or extension to pass attacker-controlled data to unserialize(); Drupal reports no such path in core.