View online: https://www.drupal.org/sa-contrib-2025-119

Project: AI (Artificial Intelligence) [1] Date: 2025-December-03 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-Site Scripting

Affected versions: <1.0.7 || >=1.1.0 <1.1.7 || >=1.2.0 <1.2.4 CVE IDs: CVE-2025-13981 Description:  This modules provides the ability to chat with an AI Agent using a large-language model (LLM) provider for different purposes.

The module doesn’t sufficiently filter LLM responses. This leads to a cross-site scripting (XSS) vulnerability where an attacker can use prompt injections on user-generated content with the LLM as context.

Solution:  Install the latest version:

* If you use the AI module 1.0.x, upgrade to AI 1.0.7 [3] * If you use the AI module 1.1.x, upgrade to AI 1.1.7 [4] * If you use the AI module 1.2.x, upgrade to AI 1.2.4 [5]

Reported By:  * Drew Webber (mcdruid) [6] of the Drupal Security Team

Fixed By:  * Marcus Johansson (marcus_johansson) [7]

Coordinated By:  * Bram Driesen (bramdriesen) [8] provisional member of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team

------------------------------------------------------------------------------ Contribution record [13]

[1] https://www.drupal.org/project/ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai/releases/1.0.7 [4] https://www.drupal.org/project/ai/releases/1.1.7 [5] https://www.drupal.org/project/ai/releases/1.2.4 [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....