CVE-2026-118546 in Drupal
Summary
by MITRE • 10/30/2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Drupal AI module, which integrates artificial intelligence capabilities into the Drupal content management system, contains a critical security flaw classified as an Improper Neutralization of Input During Web Page Generation vulnerability. This specific weakness manifests as a Cross-Site Scripting (XSS) issue within versions ranging from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2. The core technical flaw lies in the module's failure to adequately sanitize or encode user-supplied input before it is rendered into HTML output by the web server. When a Drupal site utilizes this vulnerable version of the AI module, any data entered through forms, comments, or other interactive elements that are processed and subsequently displayed without proper validation can serve as a vector for malicious script injection. This lack of rigorous input handling allows attackers to inject client-side scripts into web pages viewed by other users, bypassing standard security controls such as the same-origin policy which normally prevents malicious scripts from interacting with content on different domains.
From an operational perspective, this vulnerability poses significant risks to both site administrators and end-users who interact with the affected Drupal AI features. Successful exploitation of this XSS flaw enables attackers to execute arbitrary JavaScript in the context of the victim's browser session. This capability can be leveraged for various malicious activities including stealing sensitive information such as session cookies, authentication tokens, or personally identifiable data stored within the application interface. Furthermore, attackers may use the injected scripts to perform actions on behalf of the authenticated user without their knowledge, potentially leading to unauthorized content modifications, defacement of the website, or redirection to phishing sites designed to harvest credentials. The impact is particularly severe in environments where users have elevated privileges, as it could allow for complete compromise of administrative accounts if those sessions are active when the malicious script executes.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-79, which specifically addresses Improper Neutralization of Input During Web Page Generation: Cross-site Scripting (XSS). In terms of offensive security tactics, this flaw facilitates techniques categorized under MITRE ATT&CK ID T1059, known as Command and Scripting Interpreter. Specifically, it allows for the execution of JavaScript within a trusted web application context, which is often used in subsequent stages of an attack chain to establish persistence or escalate privileges. The absence of proper output encoding means that dynamic content generated by the AI module does not adhere to secure coding practices required to prevent script injection attacks.
To mitigate this vulnerability, site administrators must prioritize immediate remediation by upgrading the Drupal AI module to a version later than 1.5.2 where these input handling issues have been addressed and patched. Until an upgrade is feasible, implementing strict Content Security Policy headers can help restrict the execution of inline scripts and limit the damage caused by any successfully injected payloads. Additionally, developers should ensure that all user inputs are rigorously validated against expected formats and that outputs are properly encoded using context-aware encoding techniques appropriate for HTML attributes or text nodes. Regular security audits and code reviews focusing on input validation logic within custom modules can further reduce the risk of similar vulnerabilities in future deployments.