CVE-2026-84915: Drupal Component Blocks Module Input Validation Vulnerability
Summary
CVE-2026-84915: This module enables you use UI Patterns with blocks, for use in Layout Builder. Affects drupal/component_blocks versions < 1.2.7. Fixed in 1.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'component_blocks' module in Drupal enhances the Layout Builder functionality by allowing users to utilize UI Patterns with blocks. This module is designed to facilitate the creation and management of layouts within Drupal, making it easier for users to design their websites without extensive coding knowledge. However, it has been identified that the module does not adequately validate user input, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from insufficient validation of user input before it is processed for token replacement. This flaw could allow an attacker with the appropriate permissions to manipulate layout builder layouts, potentially leading to unauthorized actions or data exposure. The risk is particularly concerning as it could enable attackers to execute malicious scripts or alter the intended functionality of the website.
How To Fix
Minimum fixed version
1.2.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict user roles that have the ability to edit layout builder layouts until the module is updated. This can help mitigate the risk of exploitation until a patch is applied.
Conclusion
The CVE-2026-84915 vulnerability in the Drupal 'component_blocks' module highlights the importance of input validation in web applications. Users are strongly advised to update to the latest version to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for drupal/component_blocks →
FAQ
CVE-2026-84915 is a security vulnerability in the Drupal 'component_blocks' module that allows insufficiently validated user input to be processed, potentially leading to unauthorized actions.
Any Drupal site using the 'component_blocks' module prior to version 1.2.7 is at risk, especially if users with editing permissions are present.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
If immediate updates are not possible, consider restricting user roles that can edit layout builder layouts as a temporary measure to reduce risk.
Detailed information about this vulnerability can be found in the Drupal security advisories and on the official CVE database.
