Project: 
AI (Artificial Intelligence)
Date: 
2025-December-03
Security risk: 
Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross-Site Scripting
Affected versions: 
<1.0.7 || >=1.1.0 <1.1.7 || >=1.2.0 <1.2.4
CVE IDs: 
CVE-2025-13981
Description: 

This modules provides the ability to chat with an AI Agent using a large-language model (LLM) provider for different purposes.

The module doesn’t sufficiently filter LLM responses. This leads to a cross-site scripting (XSS) vulnerability where an attacker can use prompt injections on user-generated content with the LLM as context.

Solution: 

Install the latest version:

  • If you use the AI module 1.0.x, upgrade to AI 1.0.7.
  • If you use the AI module 1.1.x, upgrade to AI 1.1.7.
  • If you use the AI module 1.2.x, upgrade to AI 1.2.4.
Reported By: 
Fixed By: 
Coordinated By: