Object Injection Vulnerability in Drupal Block AJAX by Drupal

CVE-2026-107249

What is CVE-2026-107249?

The vulnerability in Drupal Block AJAX arises from an improperly controlled modification of dynamically-determined object attributes, which can lead to an object injection scenario. This affects versions ranging from 0.0.0 to 3.0.2. Attackers may exploit this flaw to manipulate object attributes, potentially compromising the integrity and security of applications utilizing affected versions. It is crucial for users and administrators to update to the latest versions and implement security measures to mitigate potential risks arising from this vulnerability.

References