This vulnerability, identified as CWE-915, involves improper control over modification of dynamically-determined object attributes in Drupal's Plotly.js Graphing component. This flaw enables object injection attacks, potentially allowing an attacker with low privileges to compromise confidentiality and integrity of the affected system. The affected versions include all versions from 0.0.0 up to 3.0.2. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to high confidentiality and integrity impact, allowing attackers to inject objects that may alter application behavior or access sensitive data. Availability impact is not indicated. The vulnerability can be exploited remotely over the network with low complexity and minimal privileges, without requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor channels for updates. Apply strict input validation and restrict privileges where possible to reduce risk.