Cross-site Scripting Vulnerability in Drupal AI by Drupal
CVE-2026-118553

5.5MEDIUM

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118553?

The vulnerability in Drupal AI, a product by Drupal, is due to improper neutralization of user input during web page generation, allowing for Stored Cross-site Scripting (XSS) attacks. This issue can lead to unauthorized access and potentially allow attackers to inject malicious scripts into web pages viewed by users. Affected versions include those from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2. It is crucial for users of Drupal AI to implement necessary security measures to prevent exploitation of this vulnerability.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.4.11

AI (Artificial Intelligence) 1.5.0 < 1.5.2

References

https://www.drupal.org/sa-contrib-2026-273

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Artem Dmitriiev (a.dmitriiev)
Abhisek Mazumdar (abhisekmazumdar)
Ahmad Khader (ahmad khader)
Marcus Johansson (marcus_johansson)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.