DRUPAL-CONTRIB-2026-269: XSS
Published Oct 28, 2026
·Updated
This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing.
The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS).
Affected Software
2 affected componentsFixes available
composer/drupal/ai<1.4.11
1.4.11
composer/drupal/ai>=1.5.0<1.5.2
1.5.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/aito a version that resolves this vulnerability.Fixed in 1.4.11 - Upgrade
Upgrade
composer/drupal/aito a version that resolves this vulnerability.Fixed in 1.5.2
Event History
Oct 28, 2026
Advisory Published
via OSV·05:09 PM
Data Sourced
via OSV·05:09 PM
DescriptionAffected Software