Cross-site Scripting Vulnerability in Drupal AI Software
CVE-2026-84911

3.1LOW

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
22 October 2026

What is CVE-2026-84911?

A Cross-site Scripting (XSS) vulnerability exists in Drupal AI that allows for the execution of malicious scripts stored on the server. This vulnerability impacts various versions of the AI module, where improper processing of web page generation can lead to unauthorized access and potential data compromise for users interacting with affected systems. Administrators are urged to apply security updates to mitigate risks associated with this issue.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.3.13

AI (Artificial Intelligence) 1.4.0 < 1.4.8

References

https://www.drupal.org/sa-contrib-2026-119

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Artem Dmitriiev (a.dmitriiev)
Marcus Johansson (marcus_johansson)
Valery Lourie (valthebald)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
.