SA-CONTRIB-2026-210: Critical severity drupal/smartlinker_ai vulnerability
This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to. The module's search query did not respect entity access when returning results to the browser. This vulnerability is mitigated by the fact that an user must have permission to use the AI CKEditor "Generate internal links" feature on a text format.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/smartlinker_aito a version that resolves this vulnerability.Fixed in 1.0.3 - Configuration
Restrict permission to use the AI CKEditor "Generate internal links" feature on text formats to authorized users.
AI CKEditor permission to use the "Generate internal links" feature on a text format = grant only to authorized users
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be able to use the AI CKEditor “Generate internal links” feature on a text format. This permission requirement limits exposure to users who can access that editor feature.
What information could be exposed?
The internal-link search can return site content results without respecting entity access controls. Those results are sent to the user’s browser, potentially revealing content that the user would not normally be allowed to access.