{"id":"CVE-2026-55810","aliases":["DRUPAL-CONTRIB-2026-050","EUVD-2026-43054","GHSA-gr6q-5p85-fq4q"],"status":"published","title":"Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00433,"percentile":0.38005,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-915"],"published":"2026-06-17T18:40:21Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/plotly_js","fixed_in":["3.0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/plotly_js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2"}]}]}],"products":[{"vendor":"drupal","product":"plotly.js graphing"},{"vendor":"plotly","product":"plotly.js_graphing"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-050","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55810","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gr6q-5p85-fq4q"},{"url":"https://git.drupalcode.org/project/plotly_js","tags":["web"]},{"url":"https://www.drupal.org/project/plotly_js","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55810.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-55810","title":"Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.","status":"published","published":"2026-07-10T21:44:36.859Z","modified":"2026-07-13T18:10:48.82Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-43054","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.","status":"published","published":"2026-07-10T21:44:36Z","modified":"2026-07-13T18:10:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:01.134466Z"}],"ghsa":[{"id":"GHSA-gr6q-5p85-fq4q","title":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.","status":"published","published":"2026-07-11T00:31:48Z","modified":"2026-07-13T18:31:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:09:25.900925Z"}],"nvd":[{"id":"CVE-2026-55810","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.","status":"published","published":"2026-07-10T22:16:43.867Z","modified":"2026-10-25T15:10:00.147Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:12:28.771746Z"}],"osv":[{"id":"CVE-2026-55810","title":"Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.","status":"published","published":"2026-07-10T21:44:36.859Z","modified":"2026-10-28T02:30:42.834643492Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"DRUPAL-CONTRIB-2026-050","description":"The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library.\n\nThe module stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when the data are unserialized.\n\nThis vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached `plotly_js_graph` field. In addition, the core JSON:API module must be enabled with the option \"Accept all JSON:API create, read, update, and delete operations\", which is not the default, or the attacker needs some other way to edit field values directly.","status":"published","published":"2026-06-17T18:40:21Z","modified":"2026-09-10T03:45:33.545065287Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}