En bref
- CVE-2026-118553 est une vulnérabilité MOYENNE (CVSS 5.5) touchant drupal/ai.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.14%, plus élevée que 3.8% des vulnérabilités.
- Correctif : mettre à jour vers 1.5.2, 1.4.11 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| drupal/ai Packagist:https://packages.drupal.org/8 | ≥ 1.5.0, < 1.5.2< 1.4.11
| 1.5.21.4.11
|
Description
The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields.
The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.
NVD description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free