CVE-2026-118546
Low risk· EPSS 6%Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
Risk Assessment
An attacker could inject a malicious script that executes in a user's browser, potentially leading to session or data theft. The risk applies to organizations using vulnerable versions of the AI module in Drupal.
Recommendation
Update the Drupal AI module to a version later than 1.4.11 or 1.5.2, as recommended by the vendor. If an update is not available, consider disabling the module until a fix is deployed.
Other vulnerabilities in Drupal AI
See all- CVE-2026-118549Low risk· EPSS 6%
A Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
- CVE-2026-118548Low risk· EPSS 4%
An Incorrect Authorization vulnerability in the Drupal AI (Artificial Intelligence) module allows Resource Injection. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
- CVE-2026-118545Low risk· EPSS 6%
A Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
- CVE-2026-13234Medium
A Cross-Site Scripting (XSS) vulnerability has been found in the Drupal AI (Artificial Intelligence) module due to improper input neutralization during page generation. It affects versions from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, and from 1.4.0 to 1.4.3.
- CVE-2025-31692High
An OS Command Injection vulnerability has been discovered in the AI (Artificial Intelligence) module for Drupal. The flaw allows an attacker to execute arbitrary commands on the server due to improper neutralization of special elements.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS