SA-CONTRIB-2026-272: XSS
Published Oct 28, 2026
·Updated
This module provides a framework for integrating AI providers and features into Drupal. The module doesn't sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.
Credit
Pierre Rudloff (prudloff)(the Drupal Security Team)
Affected Software
1 affected componentFixes available
composer/drupal/ai<1.5.2, <1.4.11, <1.5.2, <1.4.11
1.5.21.4.111.5.21.4.11
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/aito a version that resolves this vulnerability.Fixed in 1.5.2Fixed in 1.4.11Fixed in 1.5.2Fixed in 1.4.11
Event History
Oct 28, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which package should be checked during triage?
Check deployments using the composer/drupal/ai package.
2
What severity should be assigned to this issue?
The issue is rated critical with a severity value of 9 and a risk value of 42.