Drupal Contrib Security

Project: ColorboxDate: 2026-July-01Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: < 2.1.5 || 2.2.0CVE IDs: CVE-2026-58591Description: 

The Colorbox module integrates with the Colorbox JavaScript library to display content in an overlay above the page.

The module doesn't sufficiently protect against injection of malicious JavaScript under certain scenarios.

This vulnerability is mitigated by the fact that an attacker must have a role that permits them to enter HTML content.

Solution: 

Install the latest version:

• If you use Colorbox 2.1.x, upgrade to: Colorbox 2.1.5
• If you use Colorbox 2.2.x, upgrade to: Colorbox 2.2.1

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Paul McKibben (paulmckibben)

Coordinated By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: FlowDropDate: 2026-July-01Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.6.0CVE IDs: CVE-2026-58590Description: 

This module enables you to test and run AI-driven workflows interactively through a chat interface.

The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the user.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer FlowDrop workflows" (or the equivalent "Create FlowDrop workflows" / "Edit FlowDrop workflows" permissions).

Solution: 

Install the latest version:

• If you use the FlowDrop module for Drupal 11.x, upgrade to FlowDrop 1.6.0

Reported By: 

• Aincient Labs (aincient labs)

Fixed By: 

• Shibin Das (d34dman)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team

Project: FlowDropDate: 2026-July-01Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.6.0CVE IDs: CVE-2026-58589Description: 

This module enables you to test and run AI-driven workflows interactively through a chat interface.

The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution (incurring LLM spend and tool side effects) or send messages into other user's sessions.

This vulnerability is mitigated by the fact that an attacker must have the permission "View any session", which is not granted to anonymous or authenticated users by default.

Solution: 

Install the latest version:

• If you use the FlowDrop module for Drupal 11.x, upgrade to FlowDrop 1.6.0

Driving a session now additionally requires the "Execute session workflow" permission.

Reported By: 

• Aincient Labs (aincient labs)

Fixed By: 

• Shibin Das (d34dman)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team

Project: Drupal CanvasDate: 2026-July-01Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Improper validationAffected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1CVE IDs: CVE-2026-58588Description: 

The Canvas module allow you to upload image files via a custom API.

The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.

Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.

Solution: 

Install the latest version:

• If you use the 1.4.1 version of Canvas, upgrade to 1.4.2
• If you use the 1.5.1 version of Canvas, upgrade to 1.5.2
• If you use the 1.6.0 version of Canvas, upgrade to 1.6.1
• If you use the 1.7.0 version of Canvas, upgrade to 1.7.1

Reported By: 

• Christian López Espínola (penyaskito)

Fixed By: 

• AKHIL BABU (akhil babu)
• Christian López Espínola (penyaskito)

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team

Project: Drupal CanvasDate: 2026-July-01Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Improper validationAffected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1CVE IDs: CVE-2026-58587Description: 

The Canvas AI submodule allows you to upload image files via a custom API to use within the AI web chat.

These file uploads are insufficiently validated before being written to Drupal's temporary directory. In some cases, this may lead to cross-site scripting (XSS).

Solution: 

Install the latest version:

• If you use the 1.4.1 version of Canvas, upgrade to 1.4.2
• If you use the 1.5.1 version of Canvas, upgrade to 1.5.2
• If you use the 1.6.0 version of Canvas, upgrade to 1.6.1
• If you use the 1.7.0 version of Canvas, upgrade to 1.7.1

Reported By: 

• AKHIL BABU (akhil babu)

Fixed By: 

• Alex Bronstein (effulgentsia) of the Drupal Security Team
• Christian López Espínola (penyaskito)

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team

Project: Tealium iQ Tag ManagementDate: 2026-June-26Security risk: Critical 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: <2.4.0CVE IDs: CVE-2026-13244Description: 

The Tealium iQ Tag Management module provides Drupal integration with Tealium iQ.

tealiumiq stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an Object Injection vulnerability when the data are unserialized.

This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached tealiumiq field. In addition, the core jsonapi module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly.

Note: This project was marked as Unsupported by the Drupal Security Team on 2026-06-24 but a fix was released and the project restored on 2026-06-26.

Solution: 

Install the latest version:

• If you use the Tealium iQ Tag Management module, upgrade to Tealium iQ Tag Management 8.x.2.4

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Benji Fisher (benjifisher) of the Drupal Security Team
• Daniel Schiavone (schiavone)

Coordinated By: 

• Benji Fisher (benjifisher) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Salesforce SuiteDate: 2026-June-24Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site request forgeryAffected versions: <5.1.3CVE IDs: CVE-2026-13243Description: 

The Salesforce Suite of modules integrates Drupal with Salesforce.

The Salesforce module does not properly validate the OAuth handshake during interactive authentication, allowing an attacker to hijack the authorization token and bind the site to an attacker's Salesforce account.

This vulnerability is mitigated by the fact that salesforce_oauth submodule must be enabled, and a salesforce_oauth authorization profile active and in use. The submodule salesforce_oauth is deprecated, and salesforce_jwt has been the recommended authentication plugin for several years. Sites with salesforce_oauth uninstalled, or sites relying exclusively on salesforce_jwt (JWT or JWT Gov Cloud) for authentication are not impacted.

Submodule salesforce_oauth has been removed in branch 6.0.x, so >= 6.0.x versions are not affected by this vulnerability.

Solution: 

Recommended solution:

• Update to Salesforce Suite version 5.1.3
• Uninstall salesforce_oauth module

Alternative solution, if you must continue to use salesforce_oauth module:

• Update to Salesforce Suite version 5.1.3
• Revoke existing oauth provider tokens
• Re-authenticate all existing oauth providers

Reported By: 

• Muhammedali Aliyev (swordmein)

Fixed By: 

• Aaron Bauman (aaronbauman)

Coordinated By: 

• Neil Drumm (drumm) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Geolocation FieldDate: 2026-June-24Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: SQL InjectionAffected versions: <3.15.0CVE IDs: CVE-2026-13242Description: 

Geolocation modules adds a field to store coordinates and provides supporting plumbing for views and other modules.

One of the provided views filters does not sufficiently sanitize values if exposed to user input resulting in a SQL injection vulnerability.

This vulnerability is mitigated by the fact that a view must exist, that uses the aforementioned filter and it is set to accept user input.

Solution: 

Install the latest version:

• If you use the Geolocation Field module for Drupal, upgrade to Geolocation Field 8.x-3.15

Reported By: 

• Michael Maturi (michaelmaturi)

Fixed By: 

• Michael Maturi (michaelmaturi)
• Christian Adamski (christianadamski)

Coordinated By: 

• cilefen (cilefen) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: ParagraphsDate: 2026-June-24Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.21.0CVE IDs: CVE-2026-13241Description: 

The optional Paragraphs Library module allows the reuse of paragraphs in multiple places.
The module doesn't sufficiently restrict access to direct child paragraphs of library items through API endpoints.
This vulnerability is mitigated by the fact the paragraphs_library module must be in use and general write access to paragraphs through another module must be allowed.

Solution: 

Install the latest version:

• If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21

Reported By: 

• Mustafa Ahmed (mustafa007)

Fixed By: 

• Sascha Grossenbacher (berdir)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: ParagraphsDate: 2026-June-24Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.21.0CVE IDs: CVE-2026-13240Description: 

The optional Paragraphs Library module allows the reuse of paragraphs in multiple places.
The module doesn't sufficiently restrict access to unpublished library items in lists.
This vulnerability is mitigated by the fact the paragraphs_library module must be in use, and that an attacker must have access to a list of library items, such as a field with autocomplete suggestions or a view.

Solution: 

Install the latest version:

• If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Sascha Grossenbacher (berdir)
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: WissKIDate: 2026-June-24Security risk: Critical 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <4.2.0CVE IDs: CVE-2026-13239Description: 

The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer.

It does not sufficiently check the submitted parameters via a route and writes these to the session object without further checks, which can lead to Access Bypass.

This vulnerability is mitigated by the fact that it is specific to the wisski_mirador submodule.

Solution: 

Install the latest version:

• If you use the WissKI module version 8.x-4.1, upgrade to WissKI 8.x-4.2

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• knurg

Coordinated By: 

• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Commerce Realex / Global PaymentsDate: 2026-June-24Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Access BypassAffected versions: <3.0.2CVE IDs: CVE-2026-13238Description: 

This module enables you to take payments through the Global Payments / Realex Hosted Payment Page (HPP), either via a lightbox iframe or via a full-page redirect.

When the gateway is configured with the redirect payment method, the module doesn't sufficiently verify the authenticity of the payment response returned by Global Payments.

The lightbox payment method validates the signature and is not affected, so sites that use the lightbox payment method are not affected.

Solution: 

Install the latest version:

• If you use the commerce_realex module <=3.0.1, upgrade to commerce_realex 3.0.2.

The redirect payment response is now cryptographically verified against the merchant shared secret .

Sites that cannot update immediately should disable this payment gateway, until the update can be applied.

Reported By: 

• Bill Seremetis (bserem)

Fixed By: 

• Alan Burke (alanburke)
• Bill Seremetis (bserem)
• Jaime Seuma (jaims-dev)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI AgentsDate: 2026-June-24Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Information disclosure, Access bypassAffected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1CVE IDs: CVE-2026-13237Description: 

This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools.

Under certain circumstances, the agent inherits deterministic parameters when invoking the same tool in one request, which can lead to information disclosure.

Solution: 

Install the latest version:

• If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4
• If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5
• If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1

Reported By: 

• Andrew Belcher (andrewbelcher)
• Rob Edwards (rob_e)

Fixed By: 

• Andrew Belcher (andrewbelcher)
• Marcus Johansson (marcus_johansson)
• Rob Edwards (rob_e)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI AgentsDate: 2026-June-24Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1CVE IDs: CVE-2026-13236Description: 

This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools.

The module does not sufficiently check the required permissions when a tool loads content entities.

This vulnerability is mitigated by the fact that an agent must be configured to use the affected tool, and an attacker must have access to that agent.

Solution: 

Install the latest version:

• If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4
• If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5
• If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1

Reported By: 

• Kuniyoshi Noguchi (kuninogu)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• AKHIL BABU (akhil babu)
• harivansh sharma (harivansh)
• Kuniyoshi Noguchi (kuninogu)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team

Project: AI (Artificial Intelligence)Date: 2026-June-24Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3CVE IDs: CVE-2026-13235Description: 

This module enables you to utilize an agent to use Drupal core actions tools with bypassed access.

Certain Drupal core actions, exposed as agent tools did not have correct access validation, and some core actions were missing associated access-level definitions.

This vulnerability is mitigated by the fact that an attacker must have access to communicate with an affected agent, the site must be configured to expose the affected tools to non-privileged users.

Solution: 

Install the latest version:

• If you use the AI module 1.2.16, upgrade to AI 1.2.17
• If you use the AI module 1.3.7 upgrade to AI 1.3.8
• If you use the AI module 1.4.2 upgrade to AI 1.4.3

Reported By: 

• AKHIL BABU (akhil babu)
• Kuniyoshi Noguchi (kuninogu)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Marcus Johansson (marcus_johansson)
• Dezső Biczó (mxr576)
• Valery Lourie (valthebald)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI (Artificial Intelligence)Date: 2026-June-24Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Information Disclosure / Cross-site ScriptingAffected versions: <1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3CVE IDs: CVE-2026-13234Description: 

The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser.

Under certain circumstances, rendering of this HTML can lead to Cross Site Scripting, or exposing secret communications in the context of the LLM request.

This vulnerability is mitigated by the fact that an attacker must be able to inject text into prompts to create an attack.

Solution: 

Install the latest version:

• If you use the AI module 1.2.16, upgrade to AI 1.2.17
• If you use the AI module 1.3.7 upgrade to AI 1.3.8
• If you use the AI module 1.4.2 upgrade to AI 1.4.3

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Abhisek Mazumdar (abhisekmazumdar)
• AKHIL BABU (akhil babu)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: OpenAI ProviderDate: 2026-June-24Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Server-side Request ForgeryAffected versions: <1.1.1 || >=1.2.0 <1.2.2CVE IDs: CVE-2026-13233Description: 

This module enables you to use OpenAI as a provider for the AI module.

The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have the access to change the host url and a way to generate AI-generated images.

Solution: 

Install the latest version:

• If you use the OpenAI Provider module 1.1.0, upgrade to OpenAI Provider 1.1.1
• If you use the OpenAI module 1.2.1 upgrade to OpenAI Provider 1.2.2

Reported By: 

• Kuniyoshi Noguchi (kuninogu)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Kuniyoshi Noguchi (kuninogu)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: Advanced Content Feedback (aka admin_feedback)Date: 2026-June-24Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypass / Insecure Direct Object Reference (IDOR)Affected versions: <2.8.0CVE IDs: CVE-2026-13232Description: 

This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote.

The module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "give feedback". Note: "give feedback" is granted to anonymous and authenticated by default on install.

Solution: 

Install the latest release:

• If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8

The comment endpoint now requires an HMAC-signed token bound to the specific feedback row (issued only to the visitor who cast that vote), and a comment may be written only once, preventing both forgery of arbitrary ids and replay.

Reported By: 

• Bill Seremetis (bserem)

Fixed By: 

• Bill Seremetis (bserem)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team

Project: Advanced Content Feedback (aka admin_feedback)Date: 2026-June-24Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <2.8.0CVE IDs: CVE-2026-13231Description: 

This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses.

The module doesn't sufficiently sanitize several administrator-configured response messages (the "Yes response", "No response", and the custom text shown on a "No" answer) under the scenario where those settings contain HTML or script markup, which is then emitted as raw HTML in the feedback response shown to visitors.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer admin feedback".

Solution: 

Install the latest release:

• If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8

The configured plain-text responses are now escaped with `Html::escape()`, and the formatted "No" response is rendered through its configured text format filter (`check_markup()`) instead of being printed raw.

Reported By: 

• Bill Seremetis (bserem)

Fixed By: 

• Bill Seremetis (bserem)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Plotly.js GraphingDate: 2026-June-17Security risk: Critical 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: <3.0.2CVE IDs: CVE-2026-55810Description: 

The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library.

The module stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when the data are unserialized.

This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached plotly_js_graph field. In addition, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly.

Solution: 

Install the latest version:

• If you use the Plotly.js Graphing module for Drupal, upgrade to plotly_js-3.0.2.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Stephen Mustgrave (smustgrave)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team