Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

Summary

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

Remediation

1. Inventory every Drupal Block AJAX deployment, including staging.
2. Upgrade Drupal Block AJAX to 3.0.2.
3. Confirm the running version after the upgrade.

References

• Referencehttps://www.drupal.org/sa-contrib-2026-192