PT-2026-130581

CVE-2026-118552

Published

2026-10-28

Updated

2026-10-30

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.4.11 Drupal AI versions 1.5.0 through 1.5.2

Description This module provides a framework for integrating AI providers and features into Drupal. The issue occurs because the module does not sufficiently sanitize certain HTMX attributes, leading to Cross-Site Scripting (XSS), where malicious scripts can be injected into web pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers