---
id: "CVE-2026-107249"
kind: "vulnerability"
aliases: ["CVE-2026-107249"]
title: "Drupal Block AJAX: object injection flaw in versions up to 3.0.2"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["block-ajax", "drupal", "package", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:17:43+00:00"
first_seen_at: "2026-10-30T04:28:35+00:00"
updated_at: "2026-10-30T04:31:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107249", "first_seen_at": "2026-10-30T04:28:35+00:00"}]
---

# Drupal Block AJAX: object injection flaw in versions up to 3.0.2

Drupal Block AJAX, a Drupal module, has an object injection flaw caused by improperly controlled modification of dynamically determined object attributes. The sources do not say what an attacker gains beyond that, so the impact is unconfirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Block AJAX module version in the Drupal project (for example with `composer show drupal/block_ajax` if it was installed with Composer).
- Treat any version up to and including `3.0.2` as affected.

## Fix

- Move to a Block AJAX release newer than `3.0.2`; the sources do not name the fixed version.

## Timeline

- 2026-10-30T04:28:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107249

## From the sources

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_