View online: https://www.drupal.org/sa-contrib-2026-187 Project: AI CKEditor [1] Project machine name: ai_ckeditor Date: 2026-September-23 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Code execution via Twig templates Affected versions: <1.4.3 CVE IDs: CVE-2026-96392 Description: This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data. Solution: Install the latest version: * If you use the AI CKEditor module, upgrade to AI CKEditor 1.4.3 [3]. Reported By: * Stef Rouschop (stefro) [4] Fixed By: * Artem Dmitriiev (a.dmitriiev) [5] * Marcus Johansson (marcus_johansson) [6] * Stef Rouschop (stefro) [7] Coordinated By: * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/ai_ckeditor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_ckeditor/releases/1.4.3 [4] https://www.drupal.org/u/stefro [5] https://www.drupal.org/u/admitriiev [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/stefro [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/longwave [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....