October 2026 - Security-news - lists.drupal.org

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-272 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118552 Description: This module provides a framework for integrating AI providers and features into Drupal. The module doesn't sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. Solution: Install the latest version: * If you use version 1.5.x, upgrade to AI 1.5.2 [3]. * If you use version 1.4.x, upgrade to AI 1.4.11 [4]. * If you use version 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. Reported By: * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Ahmad Khader (ahmad khader) [9] * Marcus Johansson (marcus_johansson) [10] * Valery Lourie (valthebald) [11] Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Bram Driesen (bramdriesen) [13] of the Drupal Security Team * Greg Knaddison (greggles) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/ahmad-khader [10] https://www.drupal.org/u/marcus_johansson [11] https://www.drupal.org/u/valthebald [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/bramdriesen [14] https://www.drupal.org/u/greggles [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-271 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Less critical* 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118551 Description: This module provides a framework for integrating AI providers and features into Drupal. Audio for every speech-to-text request is written to the same file in the temporary directory and is not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the audio that another user sent for transcription. This vulnerability is mitigated by the fact that the attacker needs read access to the temporary directory, either through the server (for example a shared hosting account) or through a module or custom code that exposes temporary files to other users. Drupal core's system.temporary route only serves temporary files to the user who owns them. Solution: Install the latest version: * If you use version 1.5.x, upgrade to AI 1.5.2 [3]. * If you use version 1.4.x, upgrade to AI 1.4.11 [4]. * If you use version 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. The fix keeps the audio in memory and no longer writes it to the temporary directory. Site owners may also want to delete any leftover speech_to_text.mp3 file in the temporary directory. Reported By: * Marcus Johansson (marcus_johansson) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Abhisek Mazumdar (abhisekmazumdar) [9] Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Juraj Nemec (poker10) [13] of the Drupal Security Team * Jess (xjm) [14] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/abhisekmazumdar [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/poker10 [14] https://www.drupal.org/u/xjm [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-270 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118550 Description: This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector database for semantic search. The AI Search submodule has always been marked as 'experimental' but more importantly is deprecated. You may wish to use this as an opportunity to move to the standalone AI Search [3] which is a drop-in replacement and target of all new development. It also has the same vulnerability. The AI Search backend checks access to each search result for the current user, but this is not taken into account when Search API caches the results of a view. As a result, cached search results, including titles and other displayed fields of unpublished or access-restricted content, can be shown to users who do not have access to that content in some configurations. This vulnerability is mitigated by the fact that: * The AI Search submodule must be enabled and used with a Search API view. * The view must use Search API result caching ("Search API (time-based)", "Search API (tag-based)" or "Search API (time and tag-based)"). The default, "Search API (none)", is not affected. * A user with access to the restricted content must have run the same search within the cache lifetime. Retrieval-augmented generation (RAG) tools, AI Assistant RAG actions and custom code running Search API queries are not affected. Solution: Install the latest version: * If you use the AI module 1.5.x with the AI Search submodule, upgrade to AI 1.5.2 [4] * If you use the AI module 1.4.x with the AI Search submodule, upgrade to AI 1.4.11 [5] * If you use the AI module 1.3.x with the AI Search submodule, upgrade to AI 1.5.2 [6] or AI 1.4.11 [7] as the 1.3.x branch is now unsupported. * If you use the AI Search 1.3.x standalone module, upgrade to AI 1.3.0-alpha6 [8] * If you use the AI Search 2.0.x standalone module, upgrade to AI 2.0.0-alpha3 [9] Reported By: * Marcus Johansson (marcus_johansson) [10] * Scott Euser (scott_euser) [11] Fixed By: * Artem Dmitriiev (a.dmitriiev) [12] * Scott Euser (scott_euser) [13] Coordinated By: * Swan Kalata (akalata) [14] of the Drupal Security Team * Bram Driesen (bramdriesen) [15] of the Drupal Security Team * Greg Knaddison (greggles) [16] of the Drupal Security Team * Juraj Nemec (poker10) [17] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [18] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai_search [4] https://www.drupal.org/project/ai/releases/1.5.2 [5] https://www.drupal.org/project/ai/releases/1.4.11 [6] https://www.drupal.org/project/ai/releases/1.5.2 [7] https://www.drupal.org/project/ai/releases/1.4.11 [8] https://www.drupal.org/project/ai_search/releases/1.3.0-alpha6 [9] https://www.drupal.org/project/ai_search/releases/2.0.0-alpha3 [10] https://www.drupal.org/u/marcus_johansson [11] https://www.drupal.org/u/scott_euser [12] https://www.drupal.org/u/admitriiev [13] https://www.drupal.org/u/scott_euser [14] https://www.drupal.org/u/akalata [15] https://www.drupal.org/u/bramdriesen [16] https://www.drupal.org/u/greggles [17] https://www.drupal.org/u/poker10 [18] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-269 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118549 Description: This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing. The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS). Solution: Install the latest version: * If you use version 1.5.x, upgrade to AI 1.5.2 [3]. * If you use version 1.4.x, upgrade to AI 1.4.11 [4] * If you use version 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. Reported By: * Marcus Johansson (marcus_johansson) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Abhisek Mazumdar (abhisekmazumdar) [9] * Ahmad Khader (ahmad khader) [10] * Marcus Johansson (marcus_johansson) [11] Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Bram Driesen (bramdriesen) [13] of the Drupal Security Team * Greg Knaddison (greggles) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/abhisekmazumdar [10] https://www.drupal.org/u/ahmad-khader [11] https://www.drupal.org/u/marcus_johansson [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/bramdriesen [14] https://www.drupal.org/u/greggles [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-268 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118548 Description: This module enables you to use AI on the website. It also enables you to interact with AI providers. The module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites. This vulnerability is mitigated by the fact that an attacker must use untrusted sources when interacting with the AI module in a way that produces rendered HTML. Solution: Install the latest version: * If you use version 1.5.x, upgrade to AI 1.5.2 [3] * If you use version 1.4.x, upgrade to AI 1.4.11 [4] * If you use version 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. Reported By: * Marcus Johansson (marcus_johansson) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Ahmad Khader (ahmad khader) [9] * Marcus Johansson (marcus_johansson) [10] Coordinated By: * Swan Kalata (akalata) [11] of the Drupal Security Team * Bram Driesen (bramdriesen) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/ahmad-khader [10] https://www.drupal.org/u/marcus_johansson [11] https://www.drupal.org/u/akalata [12] https://www.drupal.org/u/bramdriesen [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/xjm [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-267 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118546 Description: This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot. Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS). This vulnerability is mitigated by the fact that an attacker must have access to administer blocks. Solution: Install the latest version: * If you use version 1.5.x, upgrade to AI 1.5.2 [3]. * If you use version 1.4.x, upgrade to AI 1.4.11 [4]. * If you use version 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. Reported By: * Marcus Johansson (marcus_johansson) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Abhisek Mazumdar (abhisekmazumdar) [9] * Ahmad Khader (ahmad khader) [10] * Marcus Johansson (marcus_johansson) [11] Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Bram Driesen (bramdriesen) [13] of the Drupal Security Team * Greg Knaddison (greggles) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/abhisekmazumdar [10] https://www.drupal.org/u/ahmad-khader [11] https://www.drupal.org/u/marcus_johansson [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/bramdriesen [14] https://www.drupal.org/u/greggles [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-266 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118545 Description: This module enables you to use AI on the website. The module does not sufficiently restrict HTML rendering, allowing cross-site scripting (XSS) under certain conditions. This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML. Solution: Install the latest version: * If you use the AI module 1.5.x, upgrade to AI 1.5.2 [3] * If you use the AI module 1.4.x, upgrade to AI 1.4.11 [4] * If you use the AI module 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. Reported By: * Marcus Johansson (marcus_johansson) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Abhisek Mazumdar (abhisekmazumdar) [9] * Ahmad Khader (ahmad khader) [10] * Marcus Johansson (marcus_johansson) [11] Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Bram Driesen (bramdriesen) [13] of the Drupal Security Team * Greg Knaddison (greggles) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/abhisekmazumdar [10] https://www.drupal.org/u/ahmad-khader [11] https://www.drupal.org/u/marcus_johansson [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/bramdriesen [14] https://www.drupal.org/u/greggles [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-265 Project: Commerce Stripe [1] Project machine name: commerce_stripe Date: 2026-September-04 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Affected versions: >=2.0.0 <2.2.3 Description: This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. Under certain rare circumstances, the module may expose a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have administrator permissions to configure payment gateways and use the Stripe Connect in conjunction with the compromise of an external service. Solution: Install the latest version: * Upgrade to Commerce Stripe 2.2.3 [3]. * Commerce Stripe 2.0.x and 2.1.x are no longer supported, so sites on older versions should also update to Commerce Stripe 2.2.3. * Commerce Stripe 8.x-1.x is not affected. Reported By: * Brian Willows (hsjbrianwillows) [4] Fixed By: * Ryan Szrama (rszrama) [5] * Tom Ashe (tomtech) [6] * Jonathan Sacksick (jsacksick) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce_stripe [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_stripe/releases/2.2.3 [4] https://www.drupal.org/u/hsjbrianwillows [5] https://www.drupal.org/u/rszrama [6] https://www.drupal.org/u/tomtech [7] https://www.drupal.org/u/jsacksick [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-264 Project: Commerce Stripe [1] Project machine name: commerce_stripe Date: 2026-September-03 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Improper verification of cryptographic signature Affected versions: <1.4 || >=2.0.0 <2.2.3 CVE IDs: CVE-2026-118559 Description: This module enables you to take payments via multiple Stripe APIs. The module doesn't sufficiently verify the cryptographic signature of a webhook event when a signing secret has not been properly configured in the payment gateway settings. This vulnerability is mitigated by the fact that not all payment gateway plugins in the module utilize webhooks. Furthermore, any payment gateway configuration with any value for its webhook signing secret will prevent inappropriate processing. Solution: Install the latest version: * Upgrade to Commerce Stripe 2.2.3 [3]. * Commerce Stripe 2.0.x and 2.1.x are no longer supported, so sites on older versions should also update to Commerce Stripe 2.2.3. * Commerce Stripe 8.x-1.x is not affected. Reported By: * Brian Willows (hsjbrianwillows) [4] Fixed By: * Ryan Szrama (rszrama) [5] * Tom Ashe (tomtech) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce_stripe [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_stripe/releases/2.2.3 [4] https://www.drupal.org/u/hsjbrianwillows [5] https://www.drupal.org/u/rszrama [6] https://www.drupal.org/u/tomtech [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-263 Project: Commerce Stripe [1] Project machine name: commerce_stripe Date: 2026-September-04 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site request forgery Affected versions: >=2.0.0 <2.2.3 CVE IDs: CVE-2026-118558 Description: This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow a an attacker to trick an administrator to click a link that bypasses Stripe payment for an order, meaning that the order would be marked as paid without any actual payment. Solution: Install the latest version: * Upgrade to Commerce Stripe 2.2.3 [3]. * Commerce Stripe 2.0.x and 2.1.x are no longer supported, so sites on older versions should also update to Commerce Stripe 2.2.3. * Commerce Stripe 8.x-1.x is not affected. Reported By: * Brian Willows (hsjbrianwillows) [4] Fixed By: * Ryan Szrama (rszrama) [5] * Tom Ashe (tomtech) [6] * Jonathan Sacksick (jsacksick) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/commerce_stripe [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_stripe/releases/2.2.3 [4] https://www.drupal.org/u/hsjbrianwillows [5] https://www.drupal.org/u/rszrama [6] https://www.drupal.org/u/tomtech [7] https://www.drupal.org/u/jsacksick [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0