SA-CONTRIB-2026-269: XSS
This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing. The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS).
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/aito a version that resolves this vulnerability.Fixed in 1.5.2Fixed in 1.4.11Fixed in 1.5.2Fixed in 1.4.11
Event History
Frequently Asked Questions
What component is affected by this issue?
The affected software is composer/drupal/ai. The issue is in a service intended to prevent cross-site scripting elements from appearing for consumers of the module.
What input requires particular scrutiny?
Markdown links require scrutiny because the module does not sufficiently validate them under certain conditions. Those conditions may allow cross-site scripting payloads to pass through the service.
What is the potential impact if the issue is exploited?
An attacker may be able to cause cross-site scripting (XSS), which can result in script content appearing in a victim's browser context.