{"id":"DRUPAL-CONTRIB-2026-273","details":"The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields.\n\nThe module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.","aliases":["CVE-2026-118553"],"modified":"2026-10-28T18:15:03.719985019Z","published":"2026-10-28T17:10:21Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-273"}],"affected":[{"package":{"name":"drupal/ai","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/ai?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}],"database_specific":{"constraint":"\u003c1.4.11"}},{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}],"database_specific":{"constraint":"\u003e=1.5.0 \u003c1.5.2"}}],"database_specific":{"affected_versions":"\u003c1.4.11 || \u003e=1.5.0 \u003c1.5.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/ai/DRUPAL-CONTRIB-2026-273.json"}}],"schema_version":"1.9.2","credits":[{"name":"Marcus Johansson (marcus_johansson)","contact":["https://www.drupal.org/u/marcus_johansson"]}]}