Cross-Site Scripting Vulnerability in Drupal AI from Drupal
CVE-2026-118546

6.5MEDIUM

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118546?

A Cross-Site Scripting (XSS) vulnerability has been identified in Drupal AI, which arises from improper handling of input during web page generation. This vulnerability can be exploited by attackers to inject malicious scripts into web pages viewed by unsuspecting users. Affected versions include Drupal AI from 0.0.0 to 1.4.11 and 1.5.0 to 1.5.2. It is crucial for organizations using Drupal AI to apply necessary updates and implement security best practices to mitigate potential risks linked to this XSS vulnerability.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.4.11

AI (Artificial Intelligence) 1.5.0 < 1.5.2

References

https://www.drupal.org/sa-contrib-2026-267

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Artem Dmitriiev (a.dmitriiev)
Abhisek Mazumdar (abhisekmazumdar)
Ahmad Khader (ahmad khader)
Marcus Johansson (marcus_johansson)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.