Cross-site Scripting Vulnerability in Drupal AI Software
CVE-2026-118545

6.5MEDIUM

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118545?

The Drupal AI software is susceptible to a Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. Attackers can exploit this flaw to inject malicious scripts into web pages viewed by users. This can lead to unauthorized access to sensitive information or manipulation of user sessions. Affected versions include those from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2, making it crucial for users to secure their installations promptly.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.4.11

AI (Artificial Intelligence) 1.5.0 < 1.5.2

References

https://www.drupal.org/sa-contrib-2026-266

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Artem Dmitriiev (a.dmitriiev)
Abhisek Mazumdar (abhisekmazumdar)
Ahmad Khader (ahmad khader)
Marcus Johansson (marcus_johansson)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.