CVE-2026-118545 in Drupal
Summary
by MITRE • 10/30/2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Drupal AI module, which integrates artificial intelligence capabilities into the Drupal content management system, contains a critical security flaw classified as an Improper Neutralization of Input During Web Page Generation vulnerability. This specific weakness is commonly known in industry standards as Cross-Site Scripting or XSS, mapped to CWE-79 in the Common Weakness Enumeration taxonomy. The vulnerability exists within versions ranging from 0.0.0 up through 1.4.11 and also affects subsequent releases from 1.5.0 to 1.5.2. In these affected iterations of the module, the application fails to adequately sanitize or validate user-supplied input before it is processed for inclusion in dynamically generated web pages. This lack of proper neutralization allows malicious scripts to be injected into the context of other users' browsers when they interact with specific features provided by the AI integration layer.
From a technical perspective, this vulnerability arises because the module does not consistently apply output encoding or input validation mechanisms required to prevent script execution in the client-side environment. When an attacker crafts a specially designed request containing malicious JavaScript code and submits it through any of the exposed endpoints within the Drupal AI interface, the server processes the input without stripping out potentially executable content. Consequently, when other users view the affected page or interact with the compromised data, their browsers execute the injected script as if it were part of the legitimate application source. This behavior aligns with stored XSS patterns where malicious payloads are saved on the target server and subsequently served to victims, although reflected variants may also be possible depending on the specific input vector exploited within the module's API or form handlers.
The operational impact of this vulnerability is severe due to its potential for widespread exploitation against authenticated users who have access to AI-related features in Drupal environments. Attackers can leverage successful XSS attacks to perform a variety of malicious actions, including stealing session cookies and authentication tokens, which facilitates account takeover and unauthorized access to sensitive administrative areas or private content. Furthermore, the vulnerability enables attackers to conduct phishing campaigns by modifying page content to mimic legitimate login forms or trusted interfaces, thereby tricking users into revealing credentials. In more advanced scenarios, the injected scripts can be used to perform actions on behalf of the victim without their knowledge, such as changing settings, deleting data, or initiating transactions if those privileges are available within the Drupal AI context. This effectively compromises the confidentiality, integrity, and availability aspects of the web application for all affected users interacting with the compromised functionality.
To mitigate this risk, organizations running any version of the Drupal AI module from 0.0.0 to 1.5.2 must immediately upgrade to a patched release where these input handling issues have been resolved by the development team. Until an update is available or applied, administrators should consider disabling the specific features that expose vulnerable endpoints if they are not essential for current operations. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of successful XSS attempts by restricting the sources from which scripts can be loaded and executed within the browser environment. Regular security audits and code reviews focusing on input validation and output encoding practices should also be conducted to ensure that future developments adhere to secure coding standards such as those outlined in OWASP guidelines, thereby reducing the likelihood of similar vulnerabilities being introduced into the application logic.