Cross-Site Scripting Vulnerability in Drupal AI Software
CVE-2026-118552

6.5MEDIUM

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118552?

A Cross-Site Scripting vulnerability exists in the Drupal AI software due to improper input neutralization during web page generation. This vulnerability allows attackers to inject malicious scripts, which may be executed in the context of users accessing the affected software. This can lead to unauthorized actions and data exposure, impacting user security and site integrity.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.4.11

AI (Artificial Intelligence) 1.5.0 < 1.5.2

References

https://www.drupal.org/sa-contrib-2026-272

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pierre Rudloff (prudloff)
Artem Dmitriiev (a.dmitriiev)
Ahmad Khader (ahmad khader)
Marcus Johansson (marcus_johansson)
Valery Lourie (valthebald)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.