DRUPAL-CONTRIB-2026-267: XSS

Q: Who can exploit this issue?

An attacker must have access to administer blocks. The issue is therefore mitigated by the need for block-administration access.

Q: Is every installation of the module affected?

The vulnerability occurs under certain configurations of the AI Chatbot submodule. The provided information does not identify the specific affected configuration or whether it is enabled by default.

Q: What is the impact if exploited?

Insufficient filtering of user input before it is rendered can allow cross-site scripting (XSS).

Published Oct 28, 2026

Updated

This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot.

Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS).

This vulnerability is mitigated by the fact that an attacker must have access to administer blocks.

Affected Software

2 affected componentsFixes available

composer/drupal/ai<1.4.11

1.4.11

composer/drupal/ai>=1.5.0<1.5.2

1.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/ai to a version that resolves this vulnerability.
Fixed in 1.4.11
Upgrade
Upgrade composer/drupal/ai to a version that resolves this vulnerability.
Fixed in 1.5.2

Event History

Oct 28, 2026

Advisory Published

via OSV·05:08 PM

Data Sourced

via OSV·05:08 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must have access to administer blocks. The issue is therefore mitigated by the need for block-administration access.

Is every installation of the module affected?

The vulnerability occurs under certain configurations of the AI Chatbot submodule. The provided information does not identify the specific affected configuration or whether it is enabled by default.

What is the impact if exploited?

Insufficient filtering of user input before it is rendered can allow cross-site scripting (XSS).

DRUPAL-CONTRIB-2026-267: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Is every installation of the module affected?

What is the impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is every installation of the module affected?

What is the impact if exploited?