Artem Dmitriiev

This module provides a framework for integrating AI providers and features into Drupal. The issue occurs because the module does not sufficiently sanitize certain HTMX attributes, leading to Cross-Site Scripting (XSS), where malicious scripts can be injected into web pages.

Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The AI Automator submodule, which enables automatic field population based on other fields, fails to sufficiently verify access to text formats. This allows users to author field data using text formats they are not authorized to use.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently restrict HTML rendering, which enables the execution of malicious scripts under certain conditions. This issue is mitigated by the requirement that an attacker must have access to a text format capable of rendering HTML.

An issue in the AI Chatbot submodule occurs when user input is not sufficiently filtered before being rendered on a web page, leading to Cross-Site Scripting (XSS). This occurs under certain configurations and requires the attacker to have permissions to administer blocks.

Incorrect authorization in the AI module allows resource injection. The module fails to sufficiently validate links under specific conditions, which could lead to the exfiltration of sensitive information to external sites. This occurs when an attacker uses untrusted sources to interact with the module in a manner that produces rendered HTML.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently validate Markdown links under certain conditions, which can lead to the execution of malicious scripts in the user's browser.

Incorrectly configured access control security levels in the AI Search submodule allow the web browser cache to contain sensitive information. While the AI Search backend verifies access for each search result, this check is ignored when Search API caches view results. Consequently, users may see cached search results, such as titles and fields of unpublished or restricted content, if a user with appropriate permissions performed the same search within the cache lifetime. This occurs when the AI Search submodule is enabled and a Search API view uses time-based, tag-based, or combined time and tag-based result caching.

Insecure storage of sensitive information occurs when audio files for speech-to-text requests are written to a single file in the temporary directory and are not deleted after processing. This allows an attacker with read access to the site's temporary directory—potentially via shared hosting or other code exposing temporary files—to retrieve audio data sent by other users for transcription.

Cross-Site Request Forgery (CSRF) occurs when a web application allows an attacker to trick an authenticated user into performing unwanted actions. The module fails to sufficiently protect routes used to delete and reorder paragraphs, allowing an attacker to trick an editor into visiting a crafted link to delete or reorder paragraphs on a node using the editor's permissions.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify field access permissions when adding, deleting, or editing paragraph items within entity reference revisions fields. This occurs while editors are modifying content directly on the rendered page. Exploitation requires the attacker to possess a role with the permissions "access frontend editing", "add paragraphs", "edit paragraphs", or "delete paragraphs", and must also have permission to update the parent entity associated with the field.

Improper neutralization of special elements used in a template engine allows for code injection. The module fails to sufficiently mitigate Twig template injections in certain rules, enabling the use of Twig functions to extract confidential system data. Twig is a template engine for PHP that allows developers to generate HTML by combining static templates with dynamic data.

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize structured results when using legacy agent setups. This issue requires an attacker to invoke a prompt injection via editorial content on sites configured using the AI 1.0.x and AI Agents 1.0.x branches with an uncommon configuration.

An authorization flaw in the AI Translate submodule allows forceful browsing. The module fails to sufficiently verify access permissions for entities, related fields, or referenced entities during the AI translation process, particularly when these components have different access levels than the parent entity. This results in a permission bypass specifically for the translation operation, although it does not grant unauthorized read or update access to the affected entities.

An authorization flaw allows forceful browsing within the module used for automatic entity translation. The system fails to sufficiently verify access permissions for the entity being translated, its related fields, or referenced entities when performing an AI translation, particularly when these components have different access levels than the parent entity. This results in a permission bypass limited strictly to the translation operation, without granting unauthorized read or update access to the affected entities.

Missing authorization allows forceful browsing within the module that provides the entity type and runtime for agents to use tools. The issue occurs because the module does not sufficiently check required permissions when a tool loads content entities. Exploitation requires that an agent be configured to use the affected tool and that the attacker has access to that agent.

Insufficient sanitization of user-supplied URLs leads to a Server-Side Request Forgery (SSRF), a flaw where an attacker can induce the server to make requests to an unintended location. Exploitation requires the attacker to have permissions to modify the host URL and the ability to generate AI-generated images.

Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module and specific submodules, including AI Automators, AI Translate, AI API Explorer, and AI Content Suggestions, enable the use of a Large Language Model (LLM) to generate HTML or Markdown for browser preview. Under certain conditions, rendering this HTML can lead to XSS or the exposure of secret communications within the context of the LLM request. This issue requires an attacker to be able to inject text into prompts to execute the attack.

A missing authorization issue allows forceful browsing. Certain Drupal core actions exposed as agent tools lack correct access validation, and some core actions are missing associated access-level definitions. This allows an agent to utilize Drupal core actions tools by bypassing access controls, provided the attacker can communicate with the affected agent and the site is configured to expose these tools to non-privileged users.

An incorrect authorization issue exists in Drupal AI (Artificial Intelligence) that allows for resource injection. The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) allow the use of a Large Language Model (LLM) to generate HTML or Markdown, and preview it in a browser. Under specific conditions, rendering this HTML can expose secret communications related to the LLM request.