CVE-2026-107249: Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
Published Oct 30, 2026
·Updated
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
Event History
Oct 30, 2026
CVE Published
via MITRE·03:10 AM
Data Sourced
via MITRE·03:10 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be treated as exposed?
Drupal installations using the Block AJAX module in any version from 0.0.0 through 3.0.2 are within the affected range.
2
Does exploitation require an authenticated account or user interaction?
The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
3
Is a fixed Block AJAX version identified?
The supplied data identifies affected versions through 3.0.2 but does not identify a fixed release.