Executive brief
The Plotly.js Graphing module for Drupal, which allows users to create interactive charts and maps, contains a critical security flaw. An attacker with permission to edit content could inject malicious data that the system processes incorrectly, potentially allowing them to take full control of the website or access sensitive data. This risk is significantly higher if the site has certain non-default data management features (JSON:API write operations) enabled.
Technical details
The Plotly.js Graphing module for Drupal fails to properly sanitize data stored as PHP-serialized strings within its custom field type. This leads to a PHP Object Injection vulnerability (CWE-915/CWE-502) when the data is subsequently unserialized. An attacker requires the ability to edit a content entity containing a 'plotly_js_graph' field. The vulnerability is most easily exploited if the Drupal core JSON:API module is enabled with write operations permitted, allowing direct modification of field values. Successful exploitation can lead to remote code execution (RCE) depending on the available POP chains in the environment. The issue is resolved in version 3.0.2.
Affected products
- Drupal Plotly.js Graphing 0.0.0 to 3.0.1
Timeline
- 2026-06-17: patched: Version 3.0.2 released
- 2026-06-17: advisory: Drupal security advisory SA-CONTRIB-2026-050 published
- 2026-07-10: disclosed: CVE-2026-55810 published to NVD