CVE-2026-84911
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8.
Risk Assessment
A malicious script could be persistently stored on the server and executed in the browsers of users visiting vulnerable pages, potentially leading to session hijacking or data theft.
Recommendation
Update the Drupal AI module to a version later than 1.3.13 or 1.4.8 that includes the security fix.
Other vulnerabilities in Drupal AI (Artificial Intelligence)
See all- CVE-2026-84912Medium
Missing Authorization vulnerability in the Drupal AI (Artificial Intelligence) module allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8.
- CVE-2026-13235Low
The AI (Artificial Intelligence) module for Drupal contains a missing authorization vulnerability that allows forceful browsing, enabling attackers to access unauthorized resources. Affected versions are from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, and from 1.4.0 to 1.4.3.
- CVE-2025-31693Medium
An OS command injection vulnerability was found in the AI (Artificial Intelligence) module for Drupal. The flaw affects versions before 1.0.5 and allows an attacker to execute arbitrary commands on the server.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS