{"id":"CVE-2026-87936","kind":"vulnerability","aliases":["CVE-2026-87936"],"related":[],"title":"Drupal amazee.ai Private AI Provider: SQL injection in versions up to 1.4.3","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.","summary":"The amazee.ai Private AI Provider module for Drupal has an SQL injection flaw, so untrusted input can alter database queries. An attacker who can reach the affected input path could read or change data in the Drupal database.","severity":"medium","cvss":6.5,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the `amazee.ai Private AI Provider` module is installed in the Drupal site, for example with `drush pm:list --filter=ai_provider_amazeeio` (module machine name unknown from the sources; confirm with the site's composer.lock).\n- Check the installed version against the affected range in the sources (0.0.0 to 1.3.7, or 1.4.0 to 1.4.3).","fix":"- Upgrade the amazee.ai Private AI Provider module to a version later than 1.4.3 (the fixed version is unknown from the sources).\n- Until patched, disable the module if it is not needed.","status":"open","published_at":"2026-10-22T02:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:48:42+00:00","updated_at":"2026-10-25T03:48:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:48:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the amazee.ai Private AI Provider module to a version later than 1.4.3 (the fixed version is unknown from the sources).\n- Until patched, disable the module if it is not needed.","reach":"unknown","title":"Drupal amazee.ai Private AI Provider: SQL injection in versions up to 1.4.3","impact":"medium","summary":"The amazee.ai Private AI Provider module for Drupal has an SQL injection flaw, so untrusted input can alter database queries. An attacker who can reach the affected input path could read or change data in the Drupal database.","category":"package","nicknames":[],"who_cares":["drupal","php","ai-tooling"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters Drupal database contents via injected SQL","analyst_note":"Confirm the fixed version and the reachable input path from the NVD entry and the Drupal security advisory for the amazee.ai module.","how_to_check":"- Check whether the `amazee.ai Private AI Provider` module is installed in the Drupal site, for example with `drush pm:list --filter=ai_provider_amazeeio` (module machine name unknown from the sources; confirm with the site's composer.lock).\n- Check the installed version against the affected range in the sources (0.0.0 to 1.3.7, or 1.4.0 to 1.4.3).","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the amazee.ai Private AI Provider module installed in the affected version ranges. The sources do not say which input paths or configurations are reachable, so unknown whether anonymous users can trigger it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3378,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87936':15A,18A '0.0.0':94C '1.3.7':96C '1.4.0':98C '1.4.3':12A,100C 'affect':51B,87C 'ai':4A,20B,28B,80C,90C 'ai-tool':19B 'allow':82C 'alter':42B 'amazee.ai':2A,26B,78C,88C 'attack':46B 'chang':57B 'command':72C 'could':54B 'cve':13A,16A 'data':58B 'databas':43B,62B 'drupal':1A,22B,32B,61B,77C 'element':67C 'flaw':37B 'improp':63C 'inject':7A,36B,74C,84C 'input':40B,52B 'issu':86C 'modul':30B 'neutral':64C 'packag':23B 'path':53B 'php':24B 'privat':3A,27B,79C,89C 'provid':5A,29B,81C,91C 'queri':44B 'reach':49B 'read':55B 'special':66C 'sql':6A,35B,71C,73C,83C 'tool':21B 'untrust':39B 'use':68C 'version':9A,92C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the amazee.ai Private AI Provider module installed in the affected version ranges. The sources do not say which input paths or configurations are reachable, so unknown whether anonymous users can trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87936","severity":null,"published_at":"2026-10-22T02:17:03+00:00","modified_at":"2026-10-22T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87936","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87936","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}