Live › vulnerability › CVE-2026-84911
Go to dashboardThe Drupal AI (Artificial Intelligence) module fails to neutralize input when generating web pages, so attacker-supplied content is stored and rendered as script. An attacker who can enter that content can run JavaScript in the browser of users who view the page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal AI (Artificial Intelligence) module in the affected version ranges. Exposure depends on who can store content that other users later view, so sites with only trusted editors face less risk. Sites without the module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=ai or the Drupal admin Extend page1.3.13 on the 1.3 line or later than 1.4.8 on the 1.4 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-84911")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.