SA-CONTRIB-2026-112: Critical severity drupal/dxpr_builder vulnerability
The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via drupalSettings. This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/dxpr_builderto a version that resolves this vulnerability.Fixed in 2.8.1
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using the 2.x version of DXPR Builder are exposed only when its AI agent features are enabled and configured with an API token. In that configuration, the token is available to all page visitors, including anonymous users.
What does an attacker need to exploit the exposure?
An attacker only needs to visit a page where the affected JavaScript settings are delivered. No authenticated account is required because the token is exposed through drupalSettings to anonymous visitors.
How can administrators tell whether their site is affected?
Check whether DXPR Builder 2.x is installed and whether AI agent features are enabled with an API token configured. If both conditions apply, inspect page-delivered drupalSettings as an anonymous visitor to determine whether the token is present.