SECURITYCRITICALCVE-2026-107249

CVE-2026-107249: Drupal Block AJAX Object Injection (CVSS 9.8)

Improperly controlled modification of object attributes in the Drupal Block AJAX module allows object injection. Versions up to 3.0.2 are affected.

Dylan H.

Security Team

October 30, 2026
2 min read
CVE-2026-107249: Drupal Block AJAX Object Injection (CVSS 9.8)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Drupal Block AJAX 0.0.0 through 3.0.2

Overview

CVE-2026-107249 is a critical vulnerability (CVSS 9.8) in the Block AJAX contributed module for Drupal. NVD describes it as an Improperly Controlled Modification of Dynamically-Determined Object Attributes flaw that allows object injection. It affects Block AJAX versions from 0.0.0 to 3.0.2. It was published on 2026-10-30.

Vulnerability Details

AttributeValue
CVE IDCVE-2026-107249
CVSS9.8 (Critical)
WeaknessImproperly controlled modification of dynamically-determined object attributes (object injection)
AffectedBlock AJAX 0.0.0 through 3.0.2
SourceNIST NVD

The NVD entry does not state a fixed version or whether exploitation has been observed. A 9.8 score typically indicates network-reachable exploitation without authentication or user interaction, but check the Drupal security advisory for confirmed specifics.

Remediation

  1. Check whether the module is installed: drush pm:list --filter=block_ajax or composer show drupal/block_ajax.
  2. Update to the release named in the Drupal security advisory for this issue, or uninstall the module if it is not needed.
  3. Rebuild caches after updating and review logs for unusual AJAX block requests with unexpected parameters.

Key Takeaways

  1. Drupal sites using Block AJAX 3.0.2 or earlier are exposed to object injection.
  2. Remove or update the module promptly; confirm fix details in the official Drupal advisory.
  3. Pair this with the actively exploited Commerce Core flaw (CVE-2026-118539) as part of a Drupal patch sweep.

Sources