{"id":"CVE-2026-107249","kind":"vulnerability","aliases":["CVE-2026-107249"],"related":[],"title":"Drupal Block AJAX: object injection flaw in versions up to 3.0.2","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.","summary":"Drupal Block AJAX, a Drupal module, has an object injection flaw caused by improperly controlled modification of dynamically determined object attributes. The sources do not say what an attacker gains beyond that, so the impact is unconfirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["block-ajax","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Block AJAX module version in the Drupal project (for example with `composer show drupal/block_ajax` if it was installed with Composer).\n- Treat any version up to and including `3.0.2` as affected.","fix":"- Move to a Block AJAX release newer than `3.0.2`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T04:17:43+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:49+00:00","updated_at":"2026-10-30T04:31:49+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Block AJAX release newer than `3.0.2`; the sources do not name the fixed version.","reach":"unknown","title":"Drupal Block AJAX: object injection flaw in versions up to 3.0.2","impact":"high","summary":"Drupal Block AJAX, a Drupal module, has an object injection flaw caused by improperly controlled modification of dynamically determined object attributes. The sources do not say what an attacker gains beyond that, so the impact is unconfirmed.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","block-ajax","php"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; object injection may allow code execution, sources do not say","analyst_note":"Check the NVD entry and the Drupal security advisory for Block AJAX to confirm the fixed version, exploit preconditions and actual impact.","how_to_check":"- Check the installed Block AJAX module version in the Drupal project (for example with `composer show drupal/block_ajax` if it was installed with Composer).\n- Treat any version up to and including `3.0.2` as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Block AJAX module at version 3.0.2 or earlier are in the stated range. The sources do not say which configuration or request path is exposed, so whether a given site is reachable is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4105,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107249':14A,17A '-2026':13A,16A '0.0.0':85C '3.0.2':11A,87C 'affect':80C 'ajax':3A,20B,26B,74C,82C 'allow':75C 'attack':52B 'attribut':44B,69C 'beyond':54B 'block':2A,19B,25B,73C,81C 'block-ajax':18B 'caus':35B 'control':38B,62C 'cve':12A,15A 'determin':42B,67C 'drupal':1A,21B,24B,28B,72C 'dynam':41B,66C 'dynamically-determin':65C 'flaw':6A,34B 'gain':53B 'impact':58B 'improp':37B,61C 'inject':5A,33B,77C 'issu':79C 'modif':39B,63C 'modul':29B 'object':4A,32B,43B,68C,76C 'packag':22B 'php':23B 'say':49B 'sourc':46B 'unconfirm':60B 'version':8A,83C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Block AJAX module at version 3.0.2 or earlier are in the stated range. The sources do not say which configuration or request path is exposed, so whether a given site is reachable is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107249","severity":null,"published_at":"2026-10-30T04:17:43+00:00","modified_at":"2026-10-30T04:17:43+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}