{"id":"DRUPAL-CONTRIB-2026-268","details":"This module enables you to use AI on the website. It also enables you to interact with AI providers.\n\nThe module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites.\n\nThis vulnerability is mitigated by the fact that an attacker must use untrusted sources when interacting with the AI module in a way that produces rendered HTML.","aliases":["CVE-2026-118548"],"modified":"2026-10-28T18:15:02.348525438Z","published":"2026-10-28T17:09:05Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-268"}],"affected":[{"package":{"name":"drupal/ai","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/ai?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}],"database_specific":{"constraint":"\u003c1.4.11"}},{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}],"database_specific":{"constraint":"\u003e=1.5.0 \u003c1.5.2"}}],"database_specific":{"affected_versions":"\u003c1.4.11 || \u003e=1.5.0 \u003c1.5.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/ai/DRUPAL-CONTRIB-2026-268.json"}}],"schema_version":"1.9.2","credits":[{"name":"Marcus Johansson (marcus_johansson)","contact":["https://www.drupal.org/u/marcus_johansson"]}]}