Cross-site Scripting Vulnerability in Drupal AI Software
CVE-2026-84911

Currently unrated

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
22 October 2026

What is CVE-2026-84911?

A Cross-site Scripting (XSS) vulnerability exists in Drupal AI that allows for the execution of malicious scripts stored on the server. This vulnerability impacts various versions of the AI module, where improper processing of web page generation can lead to unauthorized access and potential data compromise for users interacting with affected systems. Administrators are urged to apply security updates to mitigate risks associated with this issue.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.3.13

AI (Artificial Intelligence) 1.4.0 < 1.4.8

References

https://www.drupal.org/sa-contrib-2026-119

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Artem Dmitriiev (a.dmitriiev)
Marcus Johansson (marcus_johansson)
Valery Lourie (valthebald)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
.