Project: 
AI (Artificial Intelligence)
Project machine name: 
ai
Date: 
2026-October-28
Security risk: 
Critical 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross-site scripting
Affected versions: 
<1.4.11 || >=1.5.0 <1.5.2
CVE IDs: 
CVE-2026-118549
Description: 

This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing.

The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS).

Solution: 

Install the latest version:

  • If you use version 1.5.x, upgrade to AI 1.5.2.
  • If you use version 1.4.x, upgrade to AI 1.4.11
  • If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.
Reported By: 
Fixed By: 
Coordinated By: