OS Command Injection Vulnerability in Drupal AI by Drupal
CVE-2025-31693

6.6MEDIUM

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
31 March 2025

What is CVE-2025-31693?

An OS Command Injection vulnerability in Drupal AI allows attackers to execute arbitrary operating system commands. This flaw, present in versions 0.0.0 through 1.0.4, arises from improper handling of special elements, posing a risk of unauthorized command execution. Users of affected versions are encouraged to upgrade to version 1.0.5 or later to mitigate this security issue.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.0.5

References

https://www.drupal.org/sa-contrib-2025-022

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Marcus Johansson (marcus_johansson)
Drew Webber (mcdruid)
Drew Webber (mcdruid)
.
CVE-2025-31693 : OS Command Injection Vulnerability in Drupal AI by Drupal