En bref
- CVE-2025-13981 est une vulnérabilité MOYENNE (CVSS 4.4) touchant drupal/ai, artificial intelligence (artificial intelligence project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.14%, plus élevée que 3.7% des vulnérabilités.
- Correctif : mettre à jour vers 1.1.7, 1.2.4, 1.0.7 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| drupal/ai Packagist:https://packages.drupal.org/8 | ≥ 1.1.0, < 1.1.7≥ 1.2.0, < 1.2.4< 1.0.7
| 1.1.71.2.41.0.7
|
| artificial intelligence | ≥ 1.1.0, < 1.1.7≥ 1.2.0, < 1.2.4< 1.0.7
| 1.1.71.2.41.0.7
|
Description
This modules provides the ability to chat with an AI Agent using a large-language model (LLM) provider for different purposes.
The module doesn’t sufficiently filter LLM responses. This leads to a cross-site scripting (XSS) vulnerability where an attacker can use prompt injections on user-generated content with the LLM as context.
NVD description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2.0 before 1.2.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free