View online: https://www.drupal.org/sa-contrib-2026-273 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118553 Description: The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields. The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to. Solution: Install the latest version: * If you use the AI module 1.5.x, upgrade to AI 1.5.2 [3]. * If you use the AI module 1.4.x, upgrade to AI 1.4.11 [4]. * If you use the AI module 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. Reported By: * Marcus Johansson (marcus_johansson) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Abhisek Mazumdar (abhisekmazumdar) [9] * Ahmad Khader (ahmad khader) [10] * Marcus Johansson (marcus_johansson) [11] Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Bram Driesen (bramdriesen) [13] of the Drupal Security Team * Greg Knaddison (greggles) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/abhisekmazumdar [10] https://www.drupal.org/u/ahmad-khader [11] https://www.drupal.org/u/marcus_johansson [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/bramdriesen [14] https://www.drupal.org/u/greggles [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....