In breve
- CVE-2025-13981 è una vulnerabilità MEDIO (CVSS 4.4) che riguarda drupal/ai, artificial intelligence (artificial intelligence project).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.14%, superiore al 3.7% delle vulnerabilità.
- Correzione: aggiornare a 1.1.7, 1.2.4, 1.0.7 o successiva.
| Package | Affected versions | Patched versions |
|---|
| drupal/ai Packagist:https://packages.drupal.org/8 | ≥ 1.1.0, < 1.1.7≥ 1.2.0, < 1.2.4< 1.0.7
| 1.1.71.2.41.0.7
|
| artificial intelligence | ≥ 1.1.0, < 1.1.7≥ 1.2.0, < 1.2.4< 1.0.7
| 1.1.71.2.41.0.7
|
Description
This modules provides the ability to chat with an AI Agent using a large-language model (LLM) provider for different purposes.
The module doesn’t sufficiently filter LLM responses. This leads to a cross-site scripting (XSS) vulnerability where an attacker can use prompt injections on user-generated content with the LLM as context.
NVD description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2.0 before 1.2.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free