Project: 
DXPR Builder: The AI Visual Page Builder for Drupal
Date: 
2026-August-26
Security risk: 
Moderately critical 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: 
Information Disclosure
Affected versions: 
<2.8.1
CVE IDs: 
CVE-2026-81162
Description: 

The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.

The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via drupalSettings.

This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.

Solution: 

Install the latest version:

  • If you use the 2.x branch of the DXPR Builder module, upgrade to DXPR Builder 2.8.1 or later.
  • The 3.x branch is not affected as it proxies AI requests through the contributed AI module.
Reported By: 
Fixed By: 
Coordinated By: