Critical Object Injection Vulnerability in Drupal Block AJAX (CVE-2026-107249)
A critical vulnerability (CVE-2026-107249) with a CVSS score of 9.8 has been discovered in the Drupal Block AJAX module, affecting versions from 0.0.0 to 3.0.2. This Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability allows for Object Injection, posing a significant risk to Drupal installations. Immediate patching is recommended to prevent potential exploitation.