Plotly.js Graphing EUVD-2026-43054

Exploitation requires an authenticated Drupal account with at least low-level privileges (CVSS PR:L) on a site that has the Plotly.js Graphing contrib module installed and enabled at a version between 0.0.0 and 3.0.2; the attacker must be able to reach the module's graph data/configuration handling to supply attacker-controlled object keys. No user interaction is required (UI:N) and the attack is network-reachable with low complexity (AV:N/AC:L). Limiting factors: the need for valid credentials narrows the attacker pool, the module must actually be deployed (a non-default add-on, not Drupal core), and the vulnerable release range must be present; there is no availability impact, so the risk is data tampering/disclosure rather than site takedown.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1) indicates a remotely reachable, low-complexity attack that only needs low-privilege authenticated access and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with data tampering/disclosure rather than denial of service. Against that, EPSS is very low at 0.16% (6th percentile), there is no KEV listing and no public exploit identified at time of analysis, so real-world exploitation pressure is currently low. The PR:L requirement is a genuine limiter: an attacker needs a valid Drupal account with at least some access to the module's functionality, which narrows the population of exploitable sites. Net: a legitimately high-severity integrity/confidentiality bug that warrants prompt patching on affected Drupal sites, but not an emergency on the level of an actively exploited unauthenticated RCE. No conflicting-vector concerns were found; the network vector is plausible for a web-facing Drupal module.

An attacker who holds or registers a low-privileged account on a Drupal site running Plotly.js Graphing submits a crafted request to a graph-configuration endpoint, supplying attacker-chosen object keys that the module applies without validation. By injecting these keys, the attacker overwrites internal object attributes to read data they should not see or alter graph/entity state, achieving the high confidentiality and integrity impact reflected in the CVSS vector. No public exploit is identified at time of analysis, and the low attack complexity means the primary barrier is obtaining a valid account.