Project: 
AI (Artificial Intelligence)
Project machine name: 
ai
Date: 
2026-October-28
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross-site scripting
Affected versions: 
<1.4.11 || >=1.5.0 <1.5.2
CVE IDs: 
CVE-2026-118552
Description: 

This module provides a framework for integrating AI providers and features into Drupal.

The module doesn't sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

Solution: 

Install the latest version:

  • If you use version 1.5.x, upgrade to AI 1.5.2.
  • If you use version 1.4.x, upgrade to AI 1.4.11.
  • If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.
Reported By: 
Fixed By: 
Coordinated By: