CVE-2026-13234

MediumCVSS 6.1

Published: 10/07/2026(UTC)Updated: 06/08/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability has been found in the Drupal AI (Artificial Intelligence) module due to improper input neutralization during page generation. It affects versions from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, and from 1.4.0 to 1.4.3.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session theft, redirection, or sensitive data exfiltration.

Recommendation

Immediately update the AI module to version 1.2.18, 1.3.9, or 1.4.4 depending on the branch used, and review the Drupal environment for other vulnerabilities.

Other vulnerabilities in Drupal AI

CVE-2025-31692High
An OS Command Injection vulnerability has been discovered in the AI (Artificial Intelligence) module for Drupal. The flaw allows an attacker to execute arbitrary commands on the server due to improper neutralization of special elements.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS