CVE-2026-84911

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.3.13 Drupal AI versions 1.4.0 through 1.4.8

Description Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize structured results when using legacy agent setups. This issue requires an attacker to invoke a prompt injection via editorial content on sites configured using the AI 1.0.x and AI Agents 1.0.x branches with an uncommon configuration.

Recommendations Update Drupal AI versions 0.0.0 through 1.3.13 to a version newer than 1.3.13. Update Drupal AI versions 1.4.0 through 1.4.8 to a version newer than 1.4.8.