GHSA-vx9m-rfxq-gr74

Source

https://github.com/advisories/GHSA-vx9m-rfxq-gr74

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-vx9m-rfxq-gr74/GHSA-vx9m-rfxq-gr74.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vx9m-rfxq-gr74

Aliases

Published

2025-04-01T00:30:34Z

Modified

2025-12-10T23:41:02Z

Severity

6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
4.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Drupal AI Vulnerable to OS Command Injection

Details

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection. This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

Database specific

{
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-02T17:14:57Z",
    "nvd_published_at": "2025-03-31T22:15:21Z",
    "severity": "MODERATE"
}

References

Affected packages

Packagist / drupal/ai

Package

Name: drupal/ai
Purl: pkg:composer/drupal/ai

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-vx9m-rfxq-gr74/GHSA-vx9m-rfxq-gr74.json"