SA-CONTRIB-2026-267: XSS
This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot. Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS). This vulnerability is mitigated by the fact that an attacker must have access to administer blocks.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/aito a version that resolves this vulnerability.Fixed in 1.5.2Fixed in 1.4.11Fixed in 1.5.2Fixed in 1.4.11
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have access to administer blocks. The issue is limited to configurations where the AI Chatbot submodule does not sufficiently filter user input before rendering it.
Is every installation of the module affected?
No. The vulnerability is described as occurring only under certain configurations involving the AI Chatbot submodule.
What access should be reviewed while remediation is pending?
Review which users and roles can administer blocks, since that access is required to exploit the issue. Restrict block administration to trusted administrators where possible.