Live › vulnerability › CVE-2026-118545
The Drupal AI module does not sufficiently restrict HTML rendering, so cross-site scripting is possible under certain conditions. The attacker must have access to a text format that can render HTML. Fixed in AI 1.4.11 and 1.5.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites with the AI (Artificial Intelligence) module installed in a version below 1.4.11 (1.4.x) or below 1.5.2 (1.5.x), including unsupported 1.3.x. Exploiting it needs a user who can use a text format that renders HTML, so sites where only trusted staff have such formats face the least risk. Sites without the AI module can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| drupal/ai | packagist | < 1.4.11, >= 1.5.0 < 1.5.2 | 1.4.11, 1.5.2 |
composer show drupal/ai or drush pm:list --filter=ai1.4.11 on the 1.4 branch, below 1.5.2 on 1.5, or on any 1.3.x or older release1.5.2, 1.4.x to 1.4.111.4.11 or 1.5.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-118545")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.