---
id: "CVE-2026-87936"
kind: "vulnerability"
aliases: ["CVE-2026-87936"]
title: "Drupal amazee.ai Private AI Provider: SQL injection in versions up to 1.4.3"
severity: "medium"
cvss: 6.5
epss: 0.00215
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ai-tooling", "drupal", "package", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:03+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:48:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87936", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87936", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal amazee.ai Private AI Provider: SQL injection in versions up to 1.4.3

The amazee.ai Private AI Provider module for Drupal has an SQL injection flaw, so untrusted input can alter database queries. An attacker who can reach the affected input path could read or change data in the Drupal database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `amazee.ai Private AI Provider` module is installed in the Drupal site, for example with `drush pm:list --filter=ai_provider_amazeeio` (module machine name unknown from the sources; confirm with the site's composer.lock).
- Check the installed version against the affected range in the sources (0.0.0 to 1.3.7, or 1.4.0 to 1.4.3).

## Fix

- Upgrade the amazee.ai Private AI Provider module to a version later than 1.4.3 (the fixed version is unknown from the sources).
- Until patched, disable the module if it is not needed.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87936
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87936

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_