View online: https://www.drupal.org/sa-contrib-2026-267 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118546 Description: This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot. Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS). This vulnerability is mitigated by the fact that an attacker must have access to administer blocks. Solution: Install the latest version: * If you use version 1.5.x, upgrade to AI 1.5.2 [3]. * If you use version 1.4.x, upgrade to AI 1.4.11 [4]. * If you use version 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. Reported By: * Marcus Johansson (marcus_johansson) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Abhisek Mazumdar (abhisekmazumdar) [9] * Ahmad Khader (ahmad khader) [10] * Marcus Johansson (marcus_johansson) [11] Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Bram Driesen (bramdriesen) [13] of the Drupal Security Team * Greg Knaddison (greggles) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/abhisekmazumdar [10] https://www.drupal.org/u/ahmad-khader [11] https://www.drupal.org/u/marcus_johansson [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/bramdriesen [14] https://www.drupal.org/u/greggles [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....