---
id: "CVE-2026-96392"
kind: "vulnerability"
aliases: ["CVE-2026-96392"]
title: "Drupal AI CKEditor: template engine flaw allows code injection up to 1.4.3"
severity: "low"
cvss: 3.5
epss: 0.00156
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ai-ckeditor", "drupal", "package", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:09+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:45:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96392", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96392", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal AI CKEditor: template engine flaw allows code injection up to 1.4.3

The Drupal AI CKEditor module mishandles special characters in template input, which allows code injection. The sources say versions from 0.0.0 through 1.4.3 are affected and rate it low severity (CVSS 3.5) with low exploitation likelihood (EPSS 0.002).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AI CKEditor module version in the Drupal project (for example with `drush pm:list --filter=ai_ckeditor` or `composer show drupal/ai_ckeditor`, unknown if the module machine name differs)
- Treat any version at or below `1.4.3` as affected

## Fix

- Upgrade the Drupal AI CKEditor module to a version newer than `1.4.3` (the sources do not name the fixed version)

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96392
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96392

## From the sources

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_