{"id":"CVE-2026-118553","aliases":["DRUPAL-CONTRIB-2026-273","EUVD-2026-113499","GHSA-f5wg-73hh-cq5r"],"status":"published","title":"AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00145,"percentile":0.03813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-10-28T17:10:21Z","modified":"2026-11-06T12:46:29Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ai","fixed_in":["1.4.11","1.5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}]}]}],"products":[{"vendor":"drupal","product":"ai (artificial intelligence)"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-273","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118553","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f5wg-73hh-cq5r"},{"url":"https://git.drupalcode.org/project/ai","tags":["web"]},{"url":"https://www.drupal.org/project/ai","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118553.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118553","title":"AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T03:08:52.993Z","modified":"2026-11-06T12:46:29.674Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-113499","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T03:08:52Z","modified":"2026-11-06T12:46:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T14:05:02.958369Z"}],"ghsa":[{"id":"GHSA-f5wg-73hh-cq5r","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T06:31:58Z","modified":"2026-11-06T15:31:19Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-118553","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T04:18:20.69Z","modified":"2026-11-06T13:17:27.55Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"CVE-2026-118553","title":"AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T03:08:52.993Z","modified":"2026-11-08T02:30:43.459916386Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"DRUPAL-CONTRIB-2026-273","description":"The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields.\n\nThe module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.","status":"published","published":"2026-10-28T17:10:21Z","modified":"2026-10-28T18:15:03.719985019Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}