CVE-2026-13234

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13234

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13234.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13234

Aliases

DRUPAL-CONTRIB-2026-054

Published

2026-07-10T21:44:40.400Z

Modified

2026-08-08T03:30:27.661932233Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054

Details

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13234.json",
    "cna_assigner": "drupal",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / git.drupalcode.org/project/ai

Affected ranges

Type

GIT

Repo

https://git.drupalcode.org/project/ai

Events

Introduced

Fixed

eadb7fc89d8004f93815ad64056d736171291415

Introduced

aaa34ba25c37753aaa5d8e56e051f3fae1086000

Fixed

ff9da1f35cfc4398a77832462812e559ef342cb8

Introduced

cce9d82bf48dbc0082a84aab7bfac55a56eda65d

Fixed

a47e6774fb55adfb8ed2151bea7afacb047f5ede

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.0.0"
        },
        {
            "fixed": "1.2.17"
        },
        {
            "introduced": "1.3.0"
        },
        {
            "fixed": "1.3.8"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "fixed": "1.4.3"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.0-alpha1

1.0.0-alpha2

1.0.0-alpha3

1.0.0-alpha4

1.0.0-alpha5

1.0.0-alpha6

1.0.0-alpha7

1.0.0-alpha8

1.0.0-beta1

1.0.0-beta2

1.0.0-beta3

1.0.0-beta4

1.0.0-beta5

1.0.0-beta6

1.0.0-beta7

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.1.0-beta1

1.2.0

1.2.0-alpha1

1.2.0-alpha2

1.2.0-beta1

1.2.0-rc1

1.2.0-rc2

1.2.1

1.2.10

1.2.11

1.2.12

1.2.13

1.2.14

1.2.15

1.2.16

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0

1.4.1

1.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13234.json"