Reflected XSS in Drupal AI Module

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Drupal.org

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-13234

EUVD

EUVD-2026-43058

Affected Vendors & Products

Vendor	Product	Version / Range
drupal	ai	From 0.0.0 (inc) to 1.2.17 (inc)
drupal	ai	From 1.3.0 (inc) to 1.3.8 (inc)
drupal	ai	From 1.4.0 (inc) to 1.4.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Impact Analysis

The vulnerability can allow attackers to execute malicious scripts in the context of the affected website, potentially leading to unauthorized actions such as stealing user credentials, session hijacking, or defacing the website.

Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in the Drupal AI (Artificial Intelligence) module. It occurs because the software does not properly neutralize input during web page generation, allowing attackers to inject malicious scripts.

Hi! I’m here to help you understand CVE-2026-13234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70