- Package
- drupal/block_ajax
- Fixed in
- 3.0.2
- Published
- Wed 7 Oct 2026, 17:14 LisbonUpdated Mon 26 Oct 2026, 03:27 Lisbon
In plain words
The Block AJAX module does not sufficiently validate user-supplied data used to construct a block. In the worst case, this can allow PHP object injection and remote code execution. It only affects sites with Layout Builder enabled, or another block plugin that handles the data passed by this module in a potentially unsafe way.
Am I affected?
Look for drupal/block_ajax and its version in composer.lock. The advisory lists 3.0.2 as fixed but gives no affected version range. Check whether Layout Builder is enabled, or whether another block plugin handles data passed by Block AJAX in a potentially unsafe way.
What to do
Check which version you have, then update to a fixed release for your branch (3.0.2):
composer show drupal/block_ajax | grep versions
composer update drupal/block_ajaxIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
The Block AJAX module enables you to load blocks asynchronously via Ajax.
The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution.
The vulnerability is mitigated by the fact that it only affects sites that have Layout Builder enabled (or another block plugin that handles the data this module passes to it in a potentially unsafe way).
Please see the release notes for details of potentially breaking changes.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-192
- The week's digest, with the other advisories from 5 Oct 2026
- All advisories for drupal/block_ajax