Live › vulnerability › CVE-2026-87936
Go to dashboardThe amazee.ai Private AI Provider module for Drupal has an SQL injection flaw, so untrusted input can alter database queries. An attacker who can reach the affected input path could read or change data in the Drupal database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that have the amazee.ai Private AI Provider module installed in the affected version ranges. The sources do not say which input paths or configurations are reachable, so unknown whether anonymous users can trigger it.
No product ranges from the sources yet.
amazee.ai Private AI Provider module is installed in the Drupal site, for example with drush pm:list --filter=ai_provider_amazeeio (module machine name unknown from the sources; confirm with the site's composer.lock).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-87936")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.