SA-CONTRIB-2026-192: Critical severity drupal/block_ajax vulnerability
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by the fact that it only affects sites that have Layout Builder enabled (or another block plugin that handles the data this module passes to it in a potentially unsafe way). Please see the release notes for details of potentially breaking changes.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/block_ajaxto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
The issue affects sites using the Block AJAX module where Layout Builder is enabled. Sites may also be affected if another installed block plugin handles the data passed by Block AJAX in an unsafe way.
What does an attacker need to exploit this issue?
Exploitation depends on user-supplied data being passed into a block handler that processes it unsafely. The described worst-case impact is PHP object injection leading to remote code execution.
How can I assess whether my site is in the affected group?
Confirm whether the Block AJAX module is installed and whether Layout Builder is enabled. Also review any other block plugins that receive data from Block AJAX, since unsafe handling by such a plugin can make the site affected.