Project: 
AI (Artificial Intelligence)
Project machine name: 
ai
Date: 
2026-October-28
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross-site scripting
Affected versions: 
<1.4.11 || >=1.5.0 <1.5.2
CVE IDs: 
CVE-2026-118545
Description: 

This module enables you to use AI on the website.

The module does not sufficiently restrict HTML rendering, allowing cross-site scripting (XSS) under certain conditions.

This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML.

Solution: 

Install the latest version:

  • If you use the AI module 1.5.x, upgrade to AI 1.5.2
  • If you use the AI module 1.4.x, upgrade to AI 1.4.11
  • If you use the AI module 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.
Reported By: 
Fixed By: 
Coordinated By: