Live › vulnerability › CVE-2026-107249
Drupal Block AJAX, a Drupal module, has an object injection flaw caused by improperly controlled modification of dynamically determined object attributes. The sources do not say what an attacker gains beyond that, so the impact is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Block AJAX module at version 3.0.2 or earlier are in the stated range. The sources do not say which configuration or request path is exposed, so whether a given site is reachable is unknown.
No product ranges from the sources yet.
composer show drupal/block_ajax if it was installed with Composer).3.0.2 as affected.3.0.2; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-107249")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.