CVE-2026-55810

Name of the Vulnerable Software and Affected Versions Drupal Plotly.js Graphing versions 0.0.0 through 3.0.2

Description Improperly controlled modification of dynamically-determined object attributes allows object injection. The module stores certain data as PHP-serialized strings, and if malicious data is written directly to the field, it can lead to object injection during the unserialization process. This issue requires the attacker to have permissions to edit a content entity with an attached plotly js graph field. Additionally, the core JSON:API module must be enabled with the option to accept all create, read, update, and delete operations, or the attacker must have an alternative method to edit field values directly.

Recommendations Update Drupal Plotly.js Graphing to a version later than 3.0.2. Restrict permissions to edit content entities containing the plotly js graph field. Disable the option to accept all JSON:API create, read, update, and delete operations in the core JSON:API module.