SA-CONTRIB-2026-266: XSS
This module enables you to use AI on the website. The module does not sufficiently restrict HTML rendering, allowing cross-site scripting (XSS) under certain conditions. This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/aito a version that resolves this vulnerability.Fixed in 1.5.2Fixed in 1.4.11Fixed in 1.5.2Fixed in 1.4.11
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using composer/drupal/ai are exposed when untrusted users can submit content using a text format that renders HTML. The issue is mitigated where attackers do not have access to such a text format.
What does an attacker need to exploit the vulnerability?
An attacker must have access to a text format capable of rendering HTML. The provided information does not identify any additional prerequisites.
How can I assess whether my site is affected?
Review whether composer/drupal/ai is installed and whether users who should not be trusted can use text formats that render HTML. If no attacker-controlled access to an HTML-rendering text format exists, the stated mitigating condition is present.