Live › vulnerability › CVE-2026-96392
Go to dashboardThe Drupal AI CKEditor module mishandles special characters in template input, which allows code injection. The sources say versions from 0.0.0 through 1.4.3 are affected and rate it low severity (CVSS 3.5) with low exploitation likelihood (EPSS 0.002).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal AI CKEditor module at version 1.4.3 or earlier are in scope. The sources do not describe which configurations or roles make a site reachable, so unknown beyond that.
No product ranges from the sources yet.
drush pm:list --filter=ai_ckeditor or composer show drupal/ai_ckeditor, unknown if the module machine name differs)1.4.3 as affected1.4.3 (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-96392")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.