CVE-2013-4446: The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3....

Security readout for executives and security teams

CVE-2013-4446 is an old Drupal Context module flaw that could let a remote attacker run PHP code on affected sites. The risk appears limited to legacy Context versions running on PHP builds without native json_decode support, but successful exploitation would be serious for any exposed Drupal site. Exposure is most likely on legacy Drupal 6 or 7 sites using the Context module at the affected versions and an old PHP environment without json_decode support. Prioritize remediation for any internet-facing legacy Drupal site, especially where business-critical content or authenticated workflows are hosted. No active exploitation is cited, but remote code execution impact warrants prompt action. Mitigation focus: Upgrade Drupal Context to 6.x-3.2, 7.x-3.0, or later supported releases.; Confirm PHP provides native json_decode support in production environments.; Review Drupal and distribution advisories for any additional vendor guidance..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.