# drupal/ai (Packagist) vulnerabilities

18 known vulnerabilities (5 high, 9 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/drupal/ai

## Advisories (18)

### [CVE-2026-118545](https://cve.now/CVE-2026-118545): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

- Severity: Medium 6.5
- Published: Oct 30, 2026
- Affected: fixed in 1.4.11; from 1.5.0, fixed in 1.5.2.

### [CVE-2026-118546](https://cve.now/CVE-2026-118546): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

- Severity: Medium 6.5
- Published: Oct 30, 2026
- Affected: fixed in 1.4.11; from 1.5.0, fixed in 1.5.2.

### [CVE-2026-118548](https://cve.now/CVE-2026-118548): AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

- Severity: Low 3.7
- Published: Oct 30, 2026
- Affected: fixed in 1.4.11; from 1.5.0, fixed in 1.5.2.

### [CVE-2026-118549](https://cve.now/CVE-2026-118549): AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

- Severity: High 7.1
- Published: Oct 30, 2026
- Affected: fixed in 1.4.11; from 1.5.0, fixed in 1.5.2.

### [CVE-2026-118550](https://cve.now/CVE-2026-118550): AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

- Severity: Medium 5.9
- Published: Oct 30, 2026
- Affected: fixed in 1.4.11; from 1.5.0, fixed in 1.5.2.

### [CVE-2026-118551](https://cve.now/CVE-2026-118551): AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

- Severity: Low 3.1
- Published: Oct 30, 2026
- Affected: fixed in 1.4.11; from 1.5.0, fixed in 1.5.2.

### [CVE-2026-118552](https://cve.now/CVE-2026-118552): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

- Severity: Medium 6.5
- Published: Oct 30, 2026
- Affected: fixed in 1.4.11; from 1.5.0, fixed in 1.5.2.

### [CVE-2026-118553](https://cve.now/CVE-2026-118553): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

- Severity: Medium 5.5
- Published: Oct 30, 2026
- Affected: fixed in 1.4.11; from 1.5.0, fixed in 1.5.2.

### [CVE-2026-84911](https://cve.now/CVE-2026-84911): AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

- Severity: Low 3.1
- Published: Oct 22, 2026
- Affected: fixed in 1.3.13; from 1.4.0, fixed in 1.4.8.

### [CVE-2026-84912](https://cve.now/CVE-2026-84912): AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

- Severity: Medium 4.6
- Published: Oct 22, 2026
- Affected: fixed in 1.3.13; from 1.4.0, fixed in 1.4.8.

### [CVE-2026-13235](https://cve.now/CVE-2026-13235): AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

- Severity: Low 3.3
- Published: Jul 10, 2026
- Affected: fixed in 1.2.17; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.3.

### [CVE-2026-13234](https://cve.now/CVE-2026-13234): AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054

- Severity: Medium 6.1
- Published: Jul 10, 2026
- Affected: fixed in 1.2.17; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.3.

### [CVE-2026-3573](https://cve.now/CVE-2026-3573): AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028

- Severity: High 7.5
- Published: Mar 26, 2026
- Affected: fixed in 1.1.11; from 1.2.0, fixed in 1.2.12.

### [CVE-2025-13981](https://cve.now/CVE-2025-13981): AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119

- Severity: Medium 4.4
- Published: Jan 28, 2026
- Affected: fixed in 1.0.7; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.4.

### [CVE-2025-31693](https://cve.now/CVE-2025-31693): AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022

- Severity: Medium 6.6
- Published: Mar 31, 2025
- Affected: fixed in 1.0.5.

### [CVE-2025-31692](https://cve.now/CVE-2025-31692): AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

- Severity: High 7.5
- Published: Mar 31, 2025
- Affected: fixed in 1.0.5.

### [CVE-2025-31678](https://cve.now/CVE-2025-31678): AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

- Severity: High 8.2
- Published: Mar 31, 2025
- Affected: fixed in 1.0.3.

### [CVE-2025-31677](https://cve.now/CVE-2025-31677): AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

- Severity: High 8.8
- Published: Mar 31, 2025
- Affected: from 1.0.0, fixed in 1.0.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/drupal/ai
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.