DRUPAL-CONTRIB-2026-266: XSS

Q: Who can exploit this issue?

An attacker must have access to a text format that can render HTML. The issue is therefore relevant where untrusted users can create or modify content using such a format.

Q: Are installations using non-HTML text formats affected?

The provided information identifies access to a text format that can render HTML as a prerequisite for exploitation. Installations that do not grant attackers access to such a format have this stated mitigation in place.

Q: What can be done while a fix is unavailable?

Restrict untrusted users from accessing text formats that can render HTML. Review which roles can use each text format and remove access to HTML-rendering formats where it is not required.

Published Oct 28, 2026

Updated

This module enables you to use AI on the website.

The module does not sufficiently restrict HTML rendering, allowing cross-site scripting (XSS) under certain conditions.

This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML.

Affected Software

2 affected componentsFixes available

composer/drupal/ai<1.4.11

1.4.11

composer/drupal/ai>=1.5.0<1.5.2

1.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/ai to a version that resolves this vulnerability.
Fixed in 1.4.11
Upgrade
Upgrade composer/drupal/ai to a version that resolves this vulnerability.
Fixed in 1.5.2

Event History

Oct 28, 2026

Advisory Published

via OSV·05:08 PM

Data Sourced

via OSV·05:08 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must have access to a text format that can render HTML. The issue is therefore relevant where untrusted users can create or modify content using such a format.

Are installations using non-HTML text formats affected?

The provided information identifies access to a text format that can render HTML as a prerequisite for exploitation. Installations that do not grant attackers access to such a format have this stated mitigation in place.

What can be done while a fix is unavailable?

Restrict untrusted users from accessing text formats that can render HTML. Review which roles can use each text format and remove access to HTML-rendering formats where it is not required.

DRUPAL-CONTRIB-2026-266: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are installations using non-HTML text formats affected?

What can be done while a fix is unavailable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are installations using non-HTML text formats affected?

What can be done while a fix is unavailable?