Cross-site Scripting Vulnerability in Drupal AI Software
CVE-2026-118549

7.1HIGH

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118549?

The vulnerability in Drupal AI stems from improper validation of user input when generating web pages, leading to a Cross-site Scripting (XSS) risk. Attackers can exploit this issue to inject malicious scripts into web pages viewed by users, potentially compromising sensitive data or disrupting normal functionality. This vulnerability affects specific versions of Drupal AI, emphasizing the need for users to keep their software updated and implement necessary security measures to safeguard against such attacks.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.4.11

AI (Artificial Intelligence) 1.5.0 < 1.5.2

References

https://www.drupal.org/sa-contrib-2026-269

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Artem Dmitriiev (a.dmitriiev)
Abhisek Mazumdar (abhisekmazumdar)
Ahmad Khader (ahmad khader)
Marcus Johansson (marcus_johansson)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.