Drupal Block AJAX: PHP object injection via unvalidated block data
Summary
The Drupal contrib module Block AJAX (block_ajax) does not sufficiently validate user-supplied data it uses to construct a block. In the worst case, this can lead to PHP object injection and remote code execution. According to Drupal, the issue only affects sites with Layout Builder enabled or another block plugin that handles the data unsafely; the authentication requirements are not yet confirmed.
Affected
- Drupal Block AJAX (block_ajax) from 0.0.0 up to but excluding 3.0.2
- Drupal's advisory rates the issue "Highly critical"; the CVE record gives CVSS 9.8 (NVD analysis pending at time of research)
Fixed in
- Upgrade to Block AJAX 3.0.2 or later
- Release 3.0.2 reverts the Twig Tweak support that introduced the issue
- Review the configuration changes described in the release notes before upgrading
Workaround
- Disable the block_ajax module if it cannot be updated promptly
- Check whether Layout Builder is enabled on the site
- Unverified: no vendor statement confirms that these measures fully mitigate the issue
Exploitation
- No evidence of exploitation in the wild found; CISA SSVC lists exploitation as none and automatable as yes
- No public proof of concept found; this is not confirmed absence
Our recommendation
- Inventory all Drupal sites and check for block_ajax versions below 3.0.2 (for example with composer show drupal/block_ajax)
- Update to 3.0.2 and check the configuration changes from the release notes
- If an update is not possible quickly, disable the module
- Check whether Layout Builder is used and assume internet exposure until the endpoint's access is verified
- Review web server logs for unusual requests to the block AJAX route
- Recheck the NVD entry and Drupal advisory for changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Drupal Security Advisory SA-CONTRIB-2026-192 www.drupal.org
- Drupal security advisories RSS feed www.drupal.org
- OSV entry DRUPAL-CONTRIB-2026-192 osv.dev
- The DropTimes: Drupal contrib security advisories www.thedroptimes.com
- Vulners NVD record CVE-2026-107249 vulners.com
- VulDB CVE-2026-107249 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:21.
Original description (NVD)
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.