SA-CONTRIB-2026-134: SQL Injection
This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize filter values before using them to build SQL queries in its Postgres/pgvector backend, allowing SQL injection. This vulnerability is mitigated by the fact that a site must be using the module's Postgres/pgvector vector database backend for a Search API AI Search index, and must expose one of that index's non-string fields as a filter (for example, through a View) that is reachable by the attacker.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/ai_provider_amazeeioto a version that resolves this vulnerability.Fixed in 1.4.3Fixed in 1.3.7
Event History
Frequently Asked Questions
Are all sites using this module affected?
No. The issue is mitigated unless the site uses the module's Postgres/pgvector vector database backend for a Search API AI Search index and exposes a non-string index field as an attacker-reachable filter.
How can I determine whether a Search API AI Search index is exposed?
Review indexes using the Postgres/pgvector backend and identify non-string fields made available as filters. Filters reachable through a View are an example of an attacker-reachable exposure.