AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

AI (Artificial Intelligence) · Cross-site scripting · CWE-79

AffectedAI (Artificial Intelligence)

FixUpdate to 1.4.11, 1.5.2 or newer

PublishedOct 30, 03:08 · drupal

ScoredNot yet

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:09 UTC

What we know

No known exploitation. CISA KEV, checked 22:09 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

No severity score yet.

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

From drupal

Affected and fixed versions

ProductAffectedFixed inAI (Artificial Intelligence)0.0.0 – before 1.4.111.4.11AI (Artificial Intelligence)1.5.0 – before 1.5.21.5.2

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

www.drupal.org/sa-contrib-2026-272 · drupal.org

Other CVEs in AI (Artificial Intelligence)

All 17 →

–AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 · CVE-2026-118545Oct 30 –AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 · CVE-2026-118546Oct 30 –AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 · CVE-2026-118548Oct 30