CVE-2026-107249

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in…

Risk score: 64/100
CVSS: 9.8 v3.1
Published: 30 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A critical vulnerability in Drupal Block AJAX allows object injection due to an improperly controlled modification of dynamically-determined object attributes. An attacker could exploit this to inject objects, leading to high impact.
Affected: {'products': ['Drupal'], 'packages': ['Block AJAX'], 'versions': ['0.0.0 to 3.0.2']}
Fix: Upgrade to version 3.0.2 or later
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

https://www.drupal.org/sa-contrib-2026-192

Original description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

Last activity 30 Oct 2026. Patch Forecast updates every hour.