On Monday November 28th, we’ll be releasing version 3.0.0 of the drag-and-drop-v2 xblock . This release will contain a High level security fix as determined using CVSS . We’re working to figure out the exact time of the release and will post that as soon as we have it.

The update will be released on 2022-11-28T15:00:00Z (UTC) (15:00 UTC).

I’m sure you know this already Feanil but I’ll mention it anyway: Nutmeg currently uses xblock-drag-and-drop-v2==v2.3.5, which is much older than the current v2.6.0 , so if this security issue affects Nutmeg we’ll need to make sure that v3.0.0 is compatible with the named release. I have no idea whet…

@regis , the v3.0.0 release is compatible with Maple and all newer versions.

Thanks for the heads-up @feanil ! Will there be separate patches released for nutmeg and olive or are we going to have to have to bump the xblock all the way to 3.0.0 in nutmeg and olive branches as well?

This security fix has been published: xblock-drag-and-drop-v2 · PyPI The updated version of the XBlock has been merged to edx-platform in master, olive and nutmeg. feat!: update Drag and Drop v2 XBlock to prevent XSS vulnerabilities by feanil · Pull Request #31359 · openedx/edx-platform · GitHub f…

Upcoming Security Release: xblock-drag-and-drop-v2

Announcements Security

feanil (Feanil Patel) November 25, 2022, 10:09pm 6

@mtyaka We’ll have to bump the version to 3.0.0 in nutmeg and olive.

Topic		Replies	Views
Upcoming Security Release: xblock-lti-consumer Security	8	423	February 7, 2023
Chrome version (146.0.x) breaks on SVG Automatic generation for Drag and Drop xblock Development	11	155	March 25, 2026
Upcoming Moderate Security Fix for edx-platform on 2024-01-12 Security	1	284	January 12, 2024
Security: Upcoming Security Release for edx-platform on 2023-07-25 Security	1	360	July 25, 2023
Security: Upcoming security release for edx-platform 2025-05-21 Security	2	94	May 20, 2025

Upcoming Security Release: xblock-drag-and-drop-v2

Related topics