EUVD-2026-43054
GHSA-gr6q-5p85-fq4q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Web-reachable module needs a low-privilege authenticated account (PR:L) and no interaction; object injection enables data disclosure and tampering (C:H/I:H) but no service outage (A:N).
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
10DescriptionCVE.org
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.
AnalysisAI
Object injection in the Drupal Plotly.js Graphing contributed module (all releases 0.0.0 through 3.0.2) lets an authenticated attacker with low privileges tamper with dynamically-determined object attributes, undermining both confidentiality and integrity of the site. The flaw stems from improperly controlled modification of object properties (CWE-915), and the network-reachable, low-complexity CVSS 3.1 vector (8.1) reflects meaningful severity; however, EPSS is only 0.16% (6th percentile) and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Drupal account with at least low-level privileges (CVSS PR:L) on a site that has the Plotly.js Graphing contrib module installed and enabled at a version between 0.0.0 and 3.0.2; the attacker must be able to reach the module's graph data/configuration handling to supply attacker-controlled object keys. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or registers a low-privileged account on a Drupal site running Plotly.js Graphing submits a crafted request to a graph-configuration endpoint, supplying attacker-chosen object keys that the module applies without validation. By injecting these keys, the attacker overwrites internal object attributes to read data they should not see or alter graph/entity state, achieving the high confidentiality and integrity impact reflected in the CVSS vector. … |
| Remediation | Patch available per vendor advisory: upgrade the Plotly.js Graphing module to the fixed release published in Drupal SA-CONTRIB-2026-050 (https://www.drupal.org/sa-contrib-2026-050), which supersedes the vulnerable 0.0.0-3.0.2 range; the exact fixed version is not specified in the provided data, so confirm the current recommended release on the module's project page before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct a complete inventory of all Drupal instances running Plotly.js Graphing module versions 0.0.0 through 3.0.2, documenting the count of affected systems and the number of authenticated users who can access chart creation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today