9.8Critical
CVE-2026-107249Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
Weakness (CWE):
CWE-915
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Drupal | Block AJAX | 0.0.0 – < 3.0.2 |