CVE-2025-31692

HighCVSS 7.5

Published: 31/03/2025(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.72%

50th percentile - higher than 50% of all known CVEs

Summary

An OS Command Injection vulnerability has been discovered in the AI (Artificial Intelligence) module for Drupal. The flaw allows an attacker to execute arbitrary commands on the server due to improper neutralization of special elements.

Risk Assessment

An attacker can take full control of the server, steal data, or deploy malware, leading to complete system compromise.

Recommendation

Immediately update the AI module to version 1.0.5 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Drupal AI

CVE-2026-13234Medium
A Cross-Site Scripting (XSS) vulnerability has been found in the Drupal AI (Artificial Intelligence) module due to improper input neutralization during page generation. It affects versions from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, and from 1.4.0 to 1.4.3.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS