CVE-2026-107249
Received Received - Intake

Block AJAX Object Injection Vulnerability

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Drupal.org

Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-107249
EUVD
EUVD-2026-113583

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Drupal Block AJAX 0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Object Injection vulnerability caused by improperly controlled modification of dynamically-determined object attributes in Drupal Block AJAX. It allows attackers to inject malicious objects into the application by exploiting flaws in how object attributes are handled during AJAX requests.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to execute arbitrary code, take control of the affected Drupal site, steal sensitive data, or disrupt services. Systems running vulnerable versions of Block AJAX (0.0.0 to 3.0.2) are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Compliance failures may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update Drupal Block AJAX to version 3.0.3 or later to address the vulnerability. Remove or disable the module if updates are unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart