AIKIDO-2026-345544
drupal/block_ajax is vulnerable to Deserialization of Untrusted Data
80
High Risk
This Affects:
drupal/block_ajaxTL;DR
The Block AJAX module loads blocks asynchronously and does not sufficiently validate user-supplied data used to construct a block. In the worst case this can lead to PHP object injection and remote code execution. The issue is limited to sites that have Layout Builder enabled, or another block plugin that handles the data this module passes to it in an unsafe way. The fix no longer takes block configuration from the request and only renders stored block configuration entities.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and Layout Builder is enabled, or another block plugin handles the data this module passes to it in an unsafe way.
Background info
drupal/block_ajax is vulnerable to Deserialization of Untrusted Data in versions 0.0.1 - 3.0.1.
How to fix this
Upgrade the drupal/block_ajax library to the patch version. See the release notes for potentially breaking changes.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.