Project: 
AI (Artificial Intelligence)
Project machine name: 
ai
Date: 
2026-October-28
Security risk: 
Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: 
Cross-site scripting
Affected versions: 
<1.4.11 || >=1.5.0 <1.5.2
CVE IDs: 
CVE-2026-118553
Description: 

The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields.

The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.

Solution: 

Install the latest version:

  • If you use the AI module 1.5.x, upgrade to AI 1.5.2.
  • If you use the AI module 1.4.x, upgrade to AI 1.4.11.
  • If you use the AI module 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.
Reported By: 
Fixed By: 
Coordinated By: