DRUPAL-CONTRIB-2026-272: XSS

Q: What conditions are required for exploitation?

An attacker must be able to cause insufficiently sanitized HTMX attributes to be processed by the module. The available information does not specify the exact input path, required permissions, or affected feature configuration.

Q: How can I determine whether my site may be affected?

Check whether the composer/drupal/ai module is installed and whether your deployment uses functionality that processes HTMX attributes. The provided data does not identify affected versions or a specific configuration that triggers the issue.

Q: What mitigation is available if an update cannot be applied immediately?

Limit or prevent untrusted users from supplying content or values that can reach HTMX attributes handled by the module. The available information does not provide a documented workaround or configuration-based fix.

Published Oct 28, 2026

Updated

This module provides a framework for integrating AI providers and features into Drupal.

The module doesn't sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

Affected Software

2 affected componentsFixes available

composer/drupal/ai<1.4.11

1.4.11

composer/drupal/ai>=1.5.0<1.5.2

1.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/ai to a version that resolves this vulnerability.
Fixed in 1.4.11
Upgrade
Upgrade composer/drupal/ai to a version that resolves this vulnerability.
Fixed in 1.5.2

Event History

Oct 28, 2026

Advisory Published

via OSV·05:10 PM

Data Sourced

via OSV·05:10 PM

DescriptionAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to cause insufficiently sanitized HTMX attributes to be processed by the module. The available information does not specify the exact input path, required permissions, or affected feature configuration.

How can I determine whether my site may be affected?

Check whether the composer/drupal/ai module is installed and whether your deployment uses functionality that processes HTMX attributes. The provided data does not identify affected versions or a specific configuration that triggers the issue.

What mitigation is available if an update cannot be applied immediately?

Limit or prevent untrusted users from supplying content or values that can reach HTMX attributes handled by the module. The available information does not provide a documented workaround or configuration-based fix.

DRUPAL-CONTRIB-2026-272: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

How can I determine whether my site may be affected?

What mitigation is available if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

How can I determine whether my site may be affected?

What mitigation is available if an update cannot be applied immediately?