SA-CONTRIB-2026-273: Critical severity composer/drupal/ai vulnerability
The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields. The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/aito a version that resolves this vulnerability.Fixed in 1.5.2Fixed in 1.4.11Fixed in 1.5.2Fixed in 1.4.11
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the AI module's AI Automator submodule are exposed where users can author field data and the site relies on text-format access controls to restrict which formats those users may use.
What does an attacker need to exploit it?
An attacker needs the ability to author field data through AI Automator. The issue involves AI Automator allowing field data to be authored in text formats the user should not be permitted to access.
Are default installations affected?
The available information identifies AI Automator as the affected submodule, but does not state whether it is enabled by default or whether a default configuration is vulnerable.